oidc: accept both the app's public client and the server's confidential one

Explaining public vs confidential clients surfaced a gap in my own design: I had
assumed a single client id, but there are two clients here with genuinely
different properties.

  the Android app     public + PKCE, because an APK cannot keep a secret
  the admin UI        confidential, because the server can keep one in
                      /etc/echolot-server.env and weakening it to public buys
                      nothing

So the audience check now accepts either registered client id - and only those
two. "Any client of this issuer" would let every other application registered
with the same IdP authenticate here, which is the entire reason the check
exists. Either id alone is enough to enable sign-in, since an operator may
register only the app or only the admin UI.

The profile advertises the *app's* client id, since that is what a phone should
authorize as.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/cmd/echolot-server/main.go

@@ -159,14 +159,16 @@ func serve(cfg *config.Config) error {
 	// uploads=account can never be satisfied — which is the honest outcome, not a silent
 	// downgrade to anonymous.
 	var idp *oidc.Verifier
-	if cfg.OIDCIssuer != "" && cfg.OIDCClientID != "" {
+	if cfg.OIDCIssuer != "" && (cfg.OIDCClientID != "" || cfg.OIDCAppClientID != "") {
 		idp = oidc.New(oidc.Config{
-			Issuer:     cfg.OIDCIssuer,
-			ClientID:   cfg.OIDCClientID,
-			AdminGroup: cfg.OIDCAdminGroup,
+			Issuer:      cfg.OIDCIssuer,
+			ClientID:    cfg.OIDCClientID,
+			AppClientID: cfg.OIDCAppClientID,
+			AdminGroup:  cfg.OIDCAdminGroup,
 		}, nil)
 		slog.Info("identity provider configured", "issuer", cfg.OIDCIssuer,
-			"client_id", cfg.OIDCClientID, "admin_group", cfg.OIDCAdminGroup)
+			"admin_client_id", cfg.OIDCClientID, "app_client_id", cfg.OIDCAppClientID,
+			"admin_group", cfg.OIDCAdminGroup)
 		if cfg.OIDCAdminGroup == "" {
 			slog.Warn("no admin group set: nobody will be an admin via OIDC " +
 				"(set ECHOLOT_OIDC_ADMIN_GROUP)")