spec: single sign-on (12), OpenID Connect and LDAP

Owner decisions 2026-10-25: a user connects their OpenID account and signs in with either it or
their password; the admin picks passwords only, OpenID only (admins keep a password way in), or
mixed. No automatic accounts. OIDC sessions re-checked every 15 min with the refresh token;
signing out also signs out at the provider; password sign-ins keep two-step. LDAP is one more way
to check a password. Decision 0004: openid-client and ldapts. Tasks S1-S5.

docs/spec/00-overview.md

@@ -161,6 +161,8 @@ AstDB keys (family/key). This list is complete; do not add keys without updating
 | Multipart uploads | @fastify/multipart | latest |
 | Rate limiting | @fastify/rate-limit | latest |
 | Cookies | @fastify/cookie | latest (decisions/0002) |
+| OpenID Connect client | openid-client | 6.x (decisions/0004) |
+| LDAP client | ldapts | latest (decisions/0004) |
 | PostgreSQL driver | pg | latest (decisions/0002) |
 | QR codes | qrcode | latest |
 | Logging | pino | latest |