Add external auth providers

[MatthiasKainer]

The goal is to support external oauth providers as well, both as app connector, or by using an existing iam solution with edge termination

From the readme:

External OAuth Authentication

TimeTracker MCP supports external OAuth/OIDC authentication providers through two modes:

1. Better Auth Integration — OAuth providers (Google, GitHub, Microsoft Entra ID, custom OIDC) integrated directly
2. OAuth Proxy Mode — Use an external OAuth proxy with signed JWT headers for enterprise deployments
3. Disabled — Default mode with email/password only

For complete configuration instructions, see External Authentication Guide.

Quick configuration:

# Enable external auth
EXTERNAL_AUTH_MODE=better-auth  # or "proxy" or "disabled"

# For Better Auth mode - configure OAuth provider
EXTERNAL_AUTH_PROVIDER=google
OAUTH_GOOGLE_CLIENT_ID=your-client-id
OAUTH_GOOGLE_CLIENT_SECRET=your-client-secret

---

Let me know if you want some tests with that - it would mostly be mocked-tests that will stay green even if the providers change something, so I wasn't sure of the value.

There is a Claude file but no contributor guidelines, so I wasn't really sure what's expected of humans :D