fix: Register/Link with Gitea ne crée plus de session admin fantôme

Avant: get_provider('gitea') → None (pas de client OAuth configuré)
       → fallback créait automatiquement une session admin
       → le bouton 'Register with Gitea' connectait l'utilisateur en admin !

Après: affiche une page d'erreur propre:
       '⚠ Gitea OAuth not configured — The Gitea integration has not
        been set up by the server administrator. ↩ Use local login'

app/routers/auth.py

@@ -89,31 +89,28 @@ async function handleLogin(e){e.preventDefault();const email=document.getElement
 async def login(request: Request, provider: str = Query("gitea")):
     """Redirect to OAuth2 authorize page or show local login page."""
     # Local login page (POST handled by /auth/local-login)
+    from fastapi.responses import HTMLResponse
     if provider == "local":
-        from fastapi.responses import HTMLResponse
         return HTMLResponse(LOCAL_LOGIN_HTML, status_code=200)
 
     # OAuth flow — check if provider is configured
     from app.auth.providers import get_provider
     oauth_provider = get_provider(provider)
     if not oauth_provider:
-        # Fallback: no OAuth configured, create admin session
+        # OAuth provider not configured — show error instead of auto-creating admin
-        from app.db import get_conn
+        return HTMLResponse(
-        with get_conn() as conn:
+            f"""<!DOCTYPE html><html><head><title>FlowDeck</title><style>
-            user = conn.execute("SELECT * FROM users WHERE login='admin'").fetchone()
+            body{{background:#191919;color:#fff;font-family:sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center;}}
-            if not user:
+            .box{{background:#222;border:1px solid rgba(255,255,255,.08);border-radius:12px;padding:40px;max-width:420px;}}
-                conn.execute(
+            h1{{font-size:20px;margin-bottom:12px;}}p{{color:rgba(255,255,255,.5);font-size:14px;margin-bottom:16px;}}
-                    "INSERT INTO users (login, full_name, email, avatar_url, is_active) "
+            a{{color:#2383E2;}}
-                    "VALUES ('admin', 'Admin', 'admin@localhost', '', 1)"
+            </style></head><body><div class="box">
-                )
+            <h1>⚠️ {provider.title()} OAuth not configured</h1>
-                conn.commit()
+            <p>The {provider} integration has not been set up by the server administrator.</p>
-                user = conn.execute("SELECT * FROM users WHERE login='admin'").fetchone()
+            <p><a href="/auth/login?provider=local">↩ Use local login</a></p>
-        user_data = dict(user)
+            </div></body></html>""",
-        session = SessionManager.create_session(user_data)
+            status_code=200,
-        _log_login(user_data["id"], request)
+        )
-        response = RedirectResponse(url="/workspaces", status_code=302)
-        response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
-        return response
 
     state = secrets.token_hex(32)
     request.session["oauth_state"] = state