feat: Authentik login + switchable GPU prod target

Add OIDC auth for Command Center and runtime GPU endpoint selection
pointed at atc-gpu-prod (10.0.10.106), matching what is currently deployed.

ui/src/hooks/useAuth.ts

@@ -0,0 +1,42 @@
+import { useCallback, useEffect, useState } from 'react'
+
+export type AuthUser = {
+  user?: string
+  email?: string
+  name?: string
+  preferred_username?: string
+  auth_enabled?: boolean
+}
+
+type AuthState =
+  | { status: 'loading'; user: null }
+  | { status: 'anon'; user: null }
+  | { status: 'authed'; user: AuthUser }
+
+export function useAuth(): AuthState & { refresh: () => Promise<void> } {
+  const [state, setState] = useState<AuthState>({ status: 'loading', user: null })
+
+  const refresh = useCallback(async () => {
+    try {
+      const r = await fetch('/api/auth/me', { credentials: 'same-origin' })
+      if (r.status === 401) {
+        setState({ status: 'anon', user: null })
+        return
+      }
+      if (!r.ok) {
+        setState({ status: 'anon', user: null })
+        return
+      }
+      const me = (await r.json()) as AuthUser
+      setState({ status: 'authed', user: me })
+    } catch {
+      setState({ status: 'anon', user: null })
+    }
+  }, [])
+
+  useEffect(() => {
+    void refresh()
+  }, [refresh])
+
+  return { ...state, refresh }
+}