refactor(settings): validate cross-field rules in the model

The "AUTH_TYPE=oidc requires OIDC_ISSUER, OIDC_CLIENT_ID and
OIDC_FRONTEND_URL" check lived in app.py, so it only ran when the Flask
app was imported; a worker or script with the same misconfiguration
started fine. It is now a model validator on the auth group and runs
wherever Settings is loaded, with the same message.

DEPLOYMENT_TYPE, which app.py read straight from the environment to
decide whether a missing JWT_SECRET_KEY is fatal, is a documented
setting on the server group now, so it shows up in the reference like
every other variable the app reads.

docsgpt/app.py

@@ -1,5 +1,4 @@
 import logging
-import os
 import platform
 import uuid
 
@@ -170,16 +169,8 @@ def enforce_document_upload_request_size_limit():
 # only local development may use the atomic filesystem fallback.
 settings.JWT_SECRET_KEY = resolve_jwt_secret_key(
     settings.JWT_SECRET_KEY,
-    os.getenv("DEPLOYMENT_TYPE"),
+    settings.DEPLOYMENT_TYPE,
 )
-if settings.AUTH_TYPE == "oidc":
-    _missing_oidc = [
-        name
-        for name in ("OIDC_ISSUER", "OIDC_CLIENT_ID", "OIDC_FRONTEND_URL")
-        if not getattr(settings, name)
-    ]
-    if _missing_oidc:
-        raise RuntimeError(f"AUTH_TYPE=oidc requires settings: {', '.join(_missing_oidc)}")
 SIMPLE_JWT_TOKEN = None
 if settings.AUTH_TYPE == "simple_jwt":
     payload = {"sub": "local"}