v0.25.0

Added

• The oidc addon adds a "Sign in with {provider}" button to the login card for each provider listed under addons."phlat/oidc".providers in the site config. A returning identity is matched by a hash of provider and sub, stored in the user's read-only oidc field. A new identity creates a user with the provider's role.
• The oidc addon accepts back-channel logout at /@oidc/{id}/logout. The logout_token is verified against the provider's keys, and every session of that user ends.
• /@oidc (editors only) lists each provider's Callback URL and Logout Callback URL, and what is missing from its config.
• SessionRoot::loginAs(User $user) signs in a user proven by other means.
• SessionRoot::revoke($username) ends every session the user has, on any device.
• Jwt::verify($token, $keys) returns the claims of an RS256 token signed by one of a provider's JWKS keys, and throws \InvalidArgumentException for a bad signature, another algorithm or an expired token.
• Hash::sha256($value, $raw) returns the raw digest with $raw = true.
• The admin Addons list has an Open button for each mounted or automount addon, next to Info.
• An addon README can use {{key|fallback}} for a value from the addon's config in the site config.

Changed

• phlat/oidc is in the default addons of phlat/config.json.
• A URL segment may start with @ at any depth, not only the first. Creating a child page throws ValidationException for a name that is not lowercase letters, digits and hyphens, so no page can be named with a leading @.
• The admin Addons list is a plain list with Info and Open buttons.