Fix OIDC metadata caching: simple periodic refresh approach

[lovasoa]

• Add RwLock wrapper around OidcClient for atomic updates
• Spawn background task that refreshes provider metadata every 6 hours
• Replace entire client atomically when new metadata is available
• Use blocking reads for client access (fast, simple)
• Log refresh attempts and failures for operational visibility

This fixes the key rotation vulnerability where OIDC provider metadata was fetched only once at startup. The solution is explicit, minimal, and much simpler than complex on-demand caching approaches.

Changes: ~77 lines vs 450+ in previous complex implementation