feat(auth): add OIDC Provider for Matrix SSO integration

- Add OIDC Provider plugin to Better Auth configuration
- Add OIDC database tables (oauth_applications, oauth_access_tokens,
  oauth_authorization_codes, oauth_consents)
- Configure Synapse as OIDC client in homeserver.yaml
- Update Element Web config for SSO support
- Add seed script for OIDC clients (db:seed:oidc)
- Update Cloudflare tunnel config with Matrix URLs

This enables Single Sign-On between Mana Core Auth and Matrix/Synapse,
allowing users to authenticate via their existing Mana account.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cloudflared-config.yml

@@ -46,5 +46,11 @@ ingress:
   - hostname: n8n.mana.how
     service: http://localhost:5678
 
+  # Matrix (DSGVO-konformes Messaging)
+  - hostname: matrix.mana.how
+    service: http://localhost:8008
+  - hostname: element.mana.how
+    service: http://localhost:8087
+
   # Catch-all
   - service: http_status:404