feat(oidc): halkyon_oidc_flutter, the device's half of signing in with OpenID Connect (ADR 0023)

OidcBrowser opens the page of an attempt the server began (OidcStart),
waits until the browser comes back by an OidcReturn (the app's scheme,
a verified https address, or the loopback) and returns the provider's
code (OidcCode), its refusal (OidcDenied), or nothing when the person
closed the browser. It checks the returned state against the attempt's,
as the server never compares it; a wrong state, neither one code nor
one refusal, no browser or a failed way back are OidcCallbackExceptions.

halkyon_app's LoopbackWebAuth moves in with its tests, relicensed from
AGPL v3 to BSD-3-Clause by its author, the developer; GitHub's sign-in
keeps using it from there until it ends. The package is BSD-3-Clause,
publish_to: none, as the module (ADR 0023, D2, D3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0023-openid-connect-module.md

@@ -1,7 +1,13 @@
 # ADR 0023: Signing in with OpenID Connect, a module others can use
 
 - **Status:** decided 23 Oct 2026, by the developer (D1–D4); the design below is built
-  as ADR 0020's step 2, whose D12 and D13 it carries.
+  as ADR 0020's step 2, whose D12 and D13 it carries. `halkyon_oidc_flutter` built with
+  step 4 (23 Oct, night): `OidcBrowser` opens an `OidcStart`'s page and returns the
+  code (`OidcCode`), the provider's refusal (`OidcDenied`) or nothing (closed), the
+  state checked on the device, as the server never compares it; the way back an
+  `OidcReturn` (the app's scheme, a verified https address, the loopback). halkyon_app's
+  `LoopbackWebAuth` moved in, relicensed from AGPL v3 to BSD-3-Clause by its author, the
+  developer, and serves GitHub's sign-in from there until it ends.
 - **Builds on:** ADR 0014 (halkyon_base, the first Serverpod module), ADR 0020 (signing in
   with SimpleLogin only).