fix(oidc): use default import and move findAccount into config

Two related issues that prevented the OIDC provider from initializing in
oidc-provider@9.8.4:

1. require('oidc-provider') returns a module object with a default export
   (because the package is published as an ESM-compatible CJS module), not
   the class itself. The old code did `const OidcProvider = require(...)`
   and then `new OidcProvider(...)`, which produced "TypeError: OidcProvider
   is not a constructor". Switching to `const { default: OidcProvider } = ...`
   fixes this.

2. In oidc-provider@9 the findAccount hook is no longer attached via
   `provider.defaults.findAccount = ...` (defaults object is undefined in
   9.x). It must be passed as a top-level config option, alongside adapter,
   cookies, claims, etc. The old code still attached it to defaults, which
   produced "TypeError: Cannot set properties of undefined (setting
   'findAccount')".

Both fixes are required before OIDC provider can be constructed. After the
fix, server logs show:

  [OK] OIDC provider initialized
  [OK] Listening on port 3001

and `/.well-known/openid-configuration` returns the full OIDC discovery
document with all standard endpoints.

Note: this is on top of the previous commit 6eb4ba59 which already fixed the
module-level OidcService.callback() crash. Both fixes are part of the same
critical path to bring the server up.
Co-authored-by: Cursor <cursoragent@cursor.com>

src/oidc/oidcService.ts

@@ -20,7 +20,7 @@ export class OidcService {
 		if (this.instance) return this.instance;
 
 		// eslint-disable-next-line @typescript-eslint/no-var-requires
-		const OidcProvider = require('oidc-provider');
+		const { default: OidcProvider } = require('oidc-provider');
 
 		const { OidcAdapterService } = await import('./oidcAdapterService.js');
 		// eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -30,6 +30,10 @@ export class OidcService {
 		// eslint-disable-next-line @typescript-eslint/no-explicit-any
 		const provider = new (OidcProvider as any)(this.configService.issuer, {
 			adapter: (name: string) => adapterService.createAdapter(name),
+			findAccount: async (_ctx: unknown, sub: string) => ({
+				accountId: sub,
+				claims: () => ({ sub }),
+			}),
 			cookies: {
 				keys: this.configService.cookieKeys,
 				long: { httpOnly: true, sameSite: 'lax' },
@@ -64,13 +68,6 @@ export class OidcService {
 			},
 		});
 
-		provider.defaults.findAccount = async (_ctx: unknown, sub: string) => {
-			return {
-				accountId: sub,
-				claims: () => ({ sub }),
-			};
-		};
-
 		this.instance = provider;
 		return provider;
 	}