feat(openvpn): add OIDC browser authentication and setup guide

frontend/src/locales/en-US.json

@@ -221,6 +221,40 @@
     "trafficTrend": "Traffic Trend",
     "noTrafficData": "No traffic data yet (waiting for samples…)"
   },
+  "oidcGuide": {
+    "title": "Feishu / OIDC browser authentication",
+    "externalService": "Requires openvpn-auth-oauth2",
+    "app": "Create app",
+    "appShort": "Feishu developer console",
+    "identity": "Enter identity settings",
+    "identityShort": "OIDC and credentials",
+    "callback": "Set public callback",
+    "callbackShort": "HTTPS reverse proxy",
+    "test": "Test client",
+    "testShort": "Browser sign-in",
+    "appTip": "Ask a Feishu administrator to create and publish an app with the appropriate sign-in capability.",
+    "openConsole": "Open Feishu app console",
+    "appInstruction1": "Create an enterprise app, obtain its credentials, and enable the web sign-in capability.",
+    "appInstruction2": "Register a redirect URL under the app's security/redirect settings. If using a broker, use the broker's upstream callback here.",
+    "appInstruction3": "Publish the app and restrict its available users to people allowed to access this VPN.",
+    "scopeTip": "Explicitly restrict who can use the app. Existing LDAP dial-in users are not automatically linked to Feishu identities. If your tenant lacks a standard OIDC discovery endpoint, use a compatible Keycloak / Authentik broker.",
+    "issuer": "OIDC issuer URL",
+    "issuerTip": "Use an HTTPS issuer that provides standard discovery (/.well-known/openid-configuration) and ID tokens, not an authorization page URL.",
+    "clientId": "OIDC Client ID",
+    "clientSecret": "OIDC Client Secret",
+    "copySecret": "Copy from the app; hidden after saving",
+    "keepSecret": "Leave blank to retain current secret",
+    "secretTip": "Encrypted server-side and stored only in the auth service's 0600 configuration file.",
+    "baseUrl": "Public sign-in URL",
+    "baseTip": "Use a dedicated HTTPS root URL reachable before VPN connection. Give each OIDC tunnel its own endpoint.",
+    "listenPort": "Local auth service port",
+    "portTip": "The service listens on 127.0.0.1 only; each tunnel needs a distinct port.",
+    "callbackTitle": "Register this callback with the final OIDC provider",
+    "callbackTip": "With an identity broker, register this URL in the broker's OIDC client, and register the broker's upstream callback in Feishu. Reverse proxy the public endpoint to 127.0.0.1:{port}; :18080 does not handle this callback.",
+    "testTip": "Install openvpn-auth-oauth2 and OpenVPN ≥ 2.6.2, then test with a WebAuth-capable client (e.g. OpenVPN Community for Windows or Tunnelblick/Viscosity for macOS). OpenVPN Connect v3 needs individual testing.",
+    "startFailed": "Configuration generated, but the tunnel did not start. Resolve the error below and retry from the tunnel list.",
+    "fillRequired": "Enter the OIDC issuer, app credentials, and public sign-in URL"
+  },
   "tunnelEditor": {
     "title": "Edit Tunnel",
     "backToList": "Back to List",
@@ -993,7 +1027,8 @@
           "options": {
             "certificate": "Certificate Only",
             "password": "Username + Password",
-            "certificate+password": "Certificate + Password"
+            "certificate+password": "Certificate + Password",
+            "oidc": "Third-party OAuth2 / OIDC (Feishu)"
           }
         },
         "mfa_mode": {