feat: silent OIDC auth with JWT Bearer tokens for web

- Add prompt=none to silently obtain JWT when Authentik session exists
- Flutter sends Bearer token to core-api instead of forward auth cookies
- Fixes cross-subdomain cookie issues between home/api.schweitz.net
- Callback syncs with /auth/sync for user profile and roles
- API interceptor now adds Bearer token on web

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/core/api/api_interceptors.dart

@@ -10,8 +10,7 @@ import 'package:tatlock_ui/core/error/app_exception.dart';
 /// Adds authentication token to requests.
 ///
 /// - **LAN mode**: Skipped entirely (no auth required)
-/// - **Web**: Skipped (cookies handle auth via NPM forward auth)
-/// - **Mobile**: Adds Bearer token from OIDC authentication
+/// - **Web + Mobile**: Adds Bearer token from OIDC authentication
 class AuthInterceptor extends Interceptor {
   AuthInterceptor(this._ref);
 
@@ -25,17 +24,11 @@ class AuthInterceptor extends Interceptor {
       return;
     }
 
-    // Skip Bearer token on web - cookies handle auth via NPM forward auth
-    if (kIsWeb) {
-      handler.next(options);
-      return;
-    }
-
-    // Mobile: Add Bearer token from OIDC authentication
+    // Add Bearer token for all platforms (web + mobile)
     final authState = _ref.read(authProvider);
 
     authState.whenData((auth) {
-      if (auth.isAuthenticated && auth.accessToken != null && auth.accessToken != 'web-session') {
+      if (auth.isAuthenticated && auth.accessToken != null) {
         options.headers['Authorization'] = 'Bearer ${auth.accessToken}';
       }
     });