feat: OAuth link mode + settings light mode CSS variables

1. /auth/login?provider=gitea&mode=link:
   - Sauve 'oauth_mode=link' dans la session
   - Callback: link OAuth token à l'utilisateur courant (pas de nouveau compte)
   - Redirige vers /settings#integrations

2. Bouton Connect dans Settings → mode=link

3. Settings light mode: remplacé 12 couleurs codées en dur par CSS variables
   - .settings-panel, .modal-box, .settings-input
   - .admin-table th/td, .stat-card
   - .btn-sm, .btn-sm:hover

app/routers/auth.py

@@ -115,6 +115,9 @@ async def login(request: Request, provider: str = Query("gitea")):
     state = secrets.token_hex(32)
     request.session["oauth_state"] = state
     request.session["oauth_provider"] = provider
+    # Link mode: connect OAuth to current local account instead of creating new user
+    mode = request.query_params.get("mode", "")
+    request.session["oauth_mode"] = mode
     # Dynamic redirect URI based on incoming Host header
     host = request.headers.get("host", "localhost:8080")
     dynamic_redirect_uri = f"http://{host}/auth/callback"
@@ -256,6 +259,24 @@ async def callback(
     if not oauth_user:
         return HTMLResponse("<h1>Failed to get user</h1>", status_code=400)
 
+    # Link mode: connect OAuth to current session user (for Settings → Integrations)
+    oauth_mode = request.session.pop("oauth_mode", "")
+    if oauth_mode == "link":
+        from app.auth.session import get_current_user as gcu
+        current = await gcu(request)
+        if not current:
+            return HTMLResponse("<h1>Not logged in — please log in first</h1>", status_code=400)
+        from app.db import get_conn as _gc
+        with _gc() as conn:
+            conn.execute(
+                """INSERT OR REPLACE INTO user_oauth_tokens
+                   (user_id, provider, access_token, refresh_token, expires_at, updated_at)
+                   VALUES (?, ?, ?, ?, ?, CURRENT_TIMESTAMP)""",
+                (current["id"], provider_name, access_token, token_data.get("refresh_token"), token_data.get("expires_at")),
+            )
+            conn.commit()
+        return RedirectResponse(url="/settings#integrations", status_code=302)
+
     # Store user in DB
     from app.db import get_conn
     login_id = f"{provider_name}_{oauth_user['login']}"