Clarify Feishu app setup and OpenVPN OIDC source

backend/internal/service/openvpn/openvpn.go

@@ -115,6 +115,11 @@ func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{},
 		return nil, fmt.Errorf("auth_mode 必须为 certificate、password、certificate+password 或 oidc")
 	}
 	if service.Str(out, "auth_mode") == "oidc" {
+		switch service.Str(out, "oidc_provider") {
+		case "", "external", "builtin":
+		default:
+			return nil, fmt.Errorf("oidc_provider 必须为内置飞书或外部 OIDC")
+		}
 		for _, key := range []string{"oidc_issuer", "oidc_base_url"} {
 			u, err := url.Parse(service.Str(out, key))
 			if err != nil || u.Scheme != "https" || u.Hostname() == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || (key == "oidc_base_url" && u.Path != "" && u.Path != "/") {
@@ -133,7 +138,7 @@ func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{},
 		}
 		out["mfa_mode"] = "off" // 飞书 MFA 由身份提供方负责
 	} else {
-		for _, key := range []string{"oidc_issuer", "oidc_base_url", "oidc_client_id", "oidc_client_secret", "oidc_http_port", "oidc_http_secret", "oidc_management_password"} {
+		for _, key := range []string{"oidc_provider", "oidc_issuer", "oidc_base_url", "oidc_client_id", "oidc_client_secret", "oidc_http_port", "oidc_http_secret", "oidc_management_password"} {
 			delete(out, key)
 		}
 	}