feat: rebuild web UI on the shared theta42 app stack; OIDC + local admin auth

The web management UI was a bespoke minimal theme with LDAP-bind login.
Rebuild it to match the SSO Manager and Proxy — same stack, same look/feel,
same auth model. The SSH bridge, audit, metrics, and access logic are
unchanged; this is purely the web layer.

Frontend (mirrors proxy/sso):
- Express + EJS with the shared top.ejs/bottom.ejs shell, Bootstrap 5,
  jQuery, jq-repeat, FontAwesome, Socket.IO, and the shared app-base.js /
  val.js client framework (copied verbatim). Vendor libs served from
  node_modules via /static-modules; app assets via /static.
- Dashboard / Sessions / Audit pages render in the common look/feel,
  loading data through the authenticated /api/* endpoints.

Auth (mirrors proxy):
- OIDC against the SSO (utils/oidc.js + routes/auth.js + models/oidc_state)
  plus a local anti-lockout admin (models/user_redis.js, bootstrapped from
  auth.adminUsers[0] / auth.localAdminPass). AuthToken sessions carry the
  group snapshot; middleware gates the data API on adminGroups or the local
  admin. New config: oidc{} + auth.adminUsers/localAdminPass.
- /api/user/me drives the client login state; "Log in with SSO" hidden when
  oidc.enabled is false.

Verified end to end: local admin login -> token -> /api/user/me isAdmin,
metrics/sessions/audit 200 with token / 401 without / 401 bad password;
static + page shells serve; 26 tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/views/bottom.ejs

@@ -1,6 +1,24 @@
-</main>
-<footer class="foot">
-	<% if (typeof buildInfo !== 'undefined') { %><span>v<%= buildInfo.version %> · <%= buildInfo.commit %></span><% } %>
-</footer>
-</body>
+		</div>
+
+		<footer class="py-2 bg-dark text-light mt-4">
+			<div class="container-fluid d-flex flex-wrap justify-content-between align-items-center small gap-2">
+				<span class="d-flex align-items-center gap-2">
+					<a href="https://theta42.com" target="_blank">
+						<img width="64" src="/static/img/theta42.svg"/>
+					</a>
+					&copy; <%- (new Date()).getFullYear() %> theta42 &middot;
+					<a href="https://github.com/theta42/jump-host/blob/master/LICENSE" target="_blank" class="text-light">MIT License</a>
+				</span>
+				<span class="d-flex align-items-center gap-3">
+					<a href="https://theta42.github.io/jump-host/" target="_blank" class="text-light text-decoration-none">
+						<i class="fa-solid fa-book"></i> Docs
+					</a>
+					<a href="https://github.com/theta42/jump-host" target="_blank" class="text-light text-decoration-none">
+						<i class="fa-brands fa-github"></i> GitHub
+					</a>
+				</span>
+				<span>v<%- version %> (<%- commit %>)</span>
+			</div>
+		</footer>
+	</body>
 </html>