Add Authentik sign-in, fix tab scroll insets, and polish multi-account auth.

Mobile app detects SSO per server, supports OAuth sign-in, and preserves saved
sessions when adding accounts. Tab screens get proper chrome layout and tab-bar
clearance with scrollable page headers.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/auth-oauth.ts

@@ -0,0 +1,15 @@
+import type { createAuthClient } from "better-auth/react";
+
+type AuthClient = ReturnType<typeof createAuthClient>;
+
+type OAuth2SignIn = (input: {
+  providerId: string;
+  callbackURL: string;
+}) => Promise<{ error?: { message?: string } | null }>;
+
+export async function signInWithAuthentik(authClient: AuthClient, callbackURL: string) {
+  return (authClient.signIn as unknown as { oauth2: OAuth2SignIn }).oauth2({
+    providerId: "authentik",
+    callbackURL,
+  });
+}