feat(auth): auto-initiate OIDC, remove login page

- AppScaffold now handles auth: auto-starts OIDC if not authenticated
- Removed /login route and _LoginPage (no longer needed)
- Shows loading screen during auth, error screen on failure
- Seamless auth when Authentik session already exists

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/shared/layouts/app_scaffold.dart

@@ -1,5 +1,8 @@
 import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:go_router/go_router.dart';
+import 'package:tatlock_ui/core/auth/auth_provider.dart';
+import 'package:tatlock_ui/core/config/app_config.dart';
 import 'package:tatlock_ui/features/control_room/router.dart';
 import 'package:tatlock_ui/features/security/router.dart';
 import 'package:tatlock_ui/routing/app_router.dart';
@@ -7,6 +10,11 @@ import 'package:tatlock_ui/shared/layouts/widgets/top_header_bar.dart';
 
 /// Main application scaffold with top header navigation.
 ///
+/// Handles authentication automatically:
+/// - If not authenticated, auto-initiates OIDC flow
+/// - Shows loading state during authentication
+/// - Shows error state if auth fails (with retry)
+///
 /// Layout structure per UI_LAYOUT.md:
 /// ```
 /// ┌─────────────────────────────────────────────────────────────────┐
@@ -15,16 +23,55 @@ import 'package:tatlock_ui/shared/layouts/widgets/top_header_bar.dart';
 /// │  BODY: Room page content (may include room-specific sidebar)    │
 /// └─────────────────────────────────────────────────────────────────┘
 /// ```
-class AppScaffold extends StatelessWidget {
+class AppScaffold extends ConsumerStatefulWidget {
   const AppScaffold({super.key, required this.child});
 
   final Widget child;
 
+  @override
+  ConsumerState<AppScaffold> createState() => _AppScaffoldState();
+}
+
+class _AppScaffoldState extends ConsumerState<AppScaffold> {
   // Header height must match TopHeaderBar._headerHeight
   static const double _headerHeight = 56.0;
 
+  bool _authInitiated = false;
+
   @override
   Widget build(BuildContext context) {
+    // No auth required in LAN mode - show content directly
+    if (!AppConfig.requiresAuth) {
+      return _buildScaffold(context);
+    }
+
+    final authAsync = ref.watch(authProvider);
+
+    return authAsync.when(
+      data: (authState) {
+        if (authState.isAuthenticated) {
+          // Authenticated - show the app
+          _authInitiated = false; // Reset for next time
+          return _buildScaffold(context);
+        }
+
+        // Not authenticated - auto-initiate OIDC
+        if (!_authInitiated) {
+          _authInitiated = true;
+          WidgetsBinding.instance.addPostFrameCallback((_) {
+            ref.read(authProvider.notifier).signIn();
+          });
+        }
+
+        // Show loading while redirecting to Authentik
+        return _buildAuthLoadingScreen(context, 'Redirecting to sign in...');
+      },
+      loading: () => _buildAuthLoadingScreen(context, 'Checking authentication...'),
+      error: (error, _) => _buildAuthErrorScreen(context, error),
+    );
+  }
+
+  Widget _buildScaffold(BuildContext context) {
     return Scaffold(
       body: Stack(
         children: [
@@ -32,7 +79,7 @@ class AppScaffold extends StatelessWidget {
           Positioned.fill(
             child: Padding(
               padding: const EdgeInsets.only(top: _headerHeight),
-              child: child,
+              child: widget.child,
             ),
           ),
 
@@ -51,6 +98,115 @@ class AppScaffold extends StatelessWidget {
     );
   }
 
+  Widget _buildAuthLoadingScreen(BuildContext context, String message) {
+    final colorScheme = Theme.of(context).colorScheme;
+
+    return Scaffold(
+      body: Center(
+        child: Column(
+          mainAxisAlignment: MainAxisAlignment.center,
+          children: [
+            Icon(
+              Icons.home_work_outlined,
+              size: 64,
+              color: colorScheme.primary,
+            ),
+            const SizedBox(height: 24),
+            Text(
+              'Tatlock Estate',
+              style: Theme.of(context).textTheme.headlineMedium?.copyWith(
+                    fontWeight: FontWeight.w600,
+                  ),
+            ),
+            const SizedBox(height: 32),
+            const SizedBox(
+              width: 24,
+              height: 24,
+              child: CircularProgressIndicator(strokeWidth: 2),
+            ),
+            const SizedBox(height: 16),
+            Text(
+              message,
+              style: Theme.of(context).textTheme.bodyMedium?.copyWith(
+                    color: colorScheme.onSurfaceVariant,
+                  ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+
+  Widget _buildAuthErrorScreen(BuildContext context, Object error) {
+    final colorScheme = Theme.of(context).colorScheme;
+
+    return Scaffold(
+      body: Center(
+        child: ConstrainedBox(
+          constraints: const BoxConstraints(maxWidth: 400),
+          child: Card(
+            child: Padding(
+              padding: const EdgeInsets.all(32),
+              child: Column(
+                mainAxisSize: MainAxisSize.min,
+                children: [
+                  Icon(
+                    Icons.error_outline,
+                    size: 64,
+                    color: colorScheme.error,
+                  ),
+                  const SizedBox(height: 24),
+                  Text(
+                    'Authentication Failed',
+                    style: Theme.of(context).textTheme.headlineMedium?.copyWith(
+                          fontWeight: FontWeight.w600,
+                        ),
+                  ),
+                  const SizedBox(height: 16),
+                  Container(
+                    padding: const EdgeInsets.all(12),
+                    decoration: BoxDecoration(
+                      color: colorScheme.errorContainer,
+                      borderRadius: BorderRadius.circular(8),
+                    ),
+                    child: Text(
+                      _formatError(error),
+                      style: TextStyle(color: colorScheme.onErrorContainer),
+                      textAlign: TextAlign.center,
+                    ),
+                  ),
+                  const SizedBox(height: 24),
+                  FilledButton.icon(
+                    onPressed: () {
+                      _authInitiated = false;
+                      ref.read(authProvider.notifier).signIn();
+                    },
+                    icon: const Icon(Icons.refresh),
+                    label: const Text('Try again'),
+                    style: FilledButton.styleFrom(
+                      minimumSize: const Size(double.infinity, 48),
+                    ),
+                  ),
+                ],
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+
+  String _formatError(Object error) {
+    final message = error.toString();
+    if (message.contains('user_cancelled')) {
+      return 'Sign in was cancelled';
+    }
+    if (message.contains('network')) {
+      return 'Network error. Please check your connection.';
+    }
+    return 'Authentication failed. Please try again.';
+  }
+
   int _selectedIndex(BuildContext context) {
     final location = GoRouterState.of(context).matchedLocation;