feat: Authentik login + switchable GPU prod target

Add OIDC auth for Command Center and runtime GPU endpoint selection
pointed at atc-gpu-prod (10.0.10.106), matching what is currently deployed.

ui/src/App.tsx

@@ -1,4 +1,6 @@
 import { useRef, useState } from 'react'
+import { useAuth } from './hooks/useAuth'
+import { LoginView } from './components/features/LoginView'
 import { ChevronDown, ChevronUp } from 'lucide-react'
 import { useClock } from './hooks/useClock'
 import { useCommandCenter } from './hooks/useCommandCenter'
@@ -27,6 +29,7 @@ import { resolveInfraNode } from './lib/infraCatalog'
 import { cn } from './lib/utils'
 
 export default function App() {
+  const auth = useAuth()
   const clock = useClock()
   const cc = useCommandCenter()
   const [gpuChatActive, setGpuChatActive] = useState(false)
@@ -53,6 +56,19 @@ export default function App() {
     return 'Lab'
   })()
 
+  if (auth.status === 'loading') {
+    return (
+      <div className="flex h-full min-h-screen items-center justify-center bg-surface text-sm text-foreground-muted">
+        Checking session…
+      </div>
+    )
+  }
+  if (auth.status === 'anon') {
+    return <LoginView />
+  }
+
+  const userLabel = auth.user?.name || auth.user?.preferred_username || auth.user?.email || 'Signed in'
+
   return (
     <div className="flex h-full flex-col overflow-hidden bg-surface">
       <TopBar
@@ -62,6 +78,8 @@ export default function App() {
         agents={cc.agents}
         approvals={cc.approvals}
         onApprovalsClick={openApprovals}
+        userLabel={userLabel}
+        onLogout={() => { window.location.href = '/auth/logout' }}
       />
 
       <div className="flex min-h-0 flex-1 overflow-hidden">