feat(auth): allow OAuth-only registration

[Florcitaq]

STRAWBERRY

Changes

• Add a separate OAuth registration setting so enabled OAuth providers can create new users while regular username/password registration stays disabled.
• Track OAuth-created users with oauth_provider and add an OAuth password access setting that blocks local password login, password reset requests, password reset consumption, and password updates for OAuth accounts.
• Add Advanced settings controls, migration/schema updates, seed defaults, and regression tests for OAuth registration and settings persistence.

Issues

• Fixes [Enhancement]: OAUTH only self registering. #8042
• /claim [Enhancement]: OAUTH only self registering. #8042

Category

• Bug fix
• Improvement
• New feature
• Adding new one click service
• Fixing or updating existing one click service

Preview

N/A for screenshot: this is a small settings/auth flow change. The Advanced > Access page now includes OAuth registration and OAuth password access listboxes.

AI Assistance

• AI was NOT used to create this PR
• AI was used (please describe below)

If AI was used:

• Tools used: OpenAI Codex
• How extensively: Drafted and edited the implementation and tests; final patch was reviewed before submission.

Testing

• Added/updated feature tests covering OAuth registration when regular registration is disabled, rejection when both registration modes are disabled, OAuth password reset blocking, settings listbox persistence, and fillable coverage.
• Ran git diff --check successfully.
• Could not run Pest/PHP tests in this workspace because PHP, Composer, and Docker are not installed on the host.

Contributor Agreement

Important

• I have read and understood the contributor guidelines. If I have failed to follow any guideline, I understand that this PR may be closed without review.
• I have searched existing issues and pull requests (including closed ones) to ensure this isn't a duplicate.
• I have tested all the changes thoroughly with a local development instance of Coolify and I am confident that they will work as expected when a maintainer tests them.