refactor(settings): validate cross-field rules in the model

The "AUTH_TYPE=oidc requires OIDC_ISSUER, OIDC_CLIENT_ID and
OIDC_FRONTEND_URL" check lived in app.py, so it only ran when the Flask
app was imported; a worker or script with the same misconfiguration
started fine. It is now a model validator on the auth group and runs
wherever Settings is loaded, with the same message.

DEPLOYMENT_TYPE, which app.py read straight from the environment to
decide whether a missing JWT_SECRET_KEY is fatal, is a documented
setting on the server group now, so it shows up in the reference like
every other variable the app reads.

tests/core/test_settings.py

@@ -110,6 +110,21 @@ class TestReference:
         )
 
 
+@pytest.mark.unit
+class TestCrossFieldRules:
+    OIDC = {"OIDC_ISSUER": "https://idp.example/", "OIDC_CLIENT_ID": "docsgpt", "OIDC_FRONTEND_URL": "http://app"}
+
+    def test_oidc_requires_issuer_client_and_frontend(self):
+        with pytest.raises(ValidationError, match="AUTH_TYPE=oidc requires settings: OIDC_CLIENT_ID, OIDC_FRONTEND_URL"):
+            Settings.model_validate({"AUTH_TYPE": "oidc", "OIDC_ISSUER": self.OIDC["OIDC_ISSUER"]})
+
+    def test_oidc_with_required_settings_loads(self):
+        assert Settings.model_validate({"AUTH_TYPE": "OIDC", **self.OIDC}).AUTH_TYPE == "oidc"
+
+    def test_oidc_settings_are_not_required_for_other_modes(self):
+        assert Settings.model_validate({"AUTH_TYPE": "session_jwt"}).OIDC_ISSUER is None
+
+
 @pytest.mark.unit
 class TestClosedChoices:
     """Enum-like settings are Literal types: a typo fails at startup instead of falling through."""
@@ -121,7 +136,7 @@ class TestClosedChoices:
     @pytest.mark.parametrize(
         ("name", "raw", "expected"),
         [
-            ("AUTH_TYPE", " OIDC ", "oidc"),
+            ("AUTH_TYPE", " Session_JWT ", "session_jwt"),
             ("VECTOR_STORE", "PGVector", "pgvector"),
             ("STORAGE_TYPE", "S3", "s3"),
             ("URL_STRATEGY", "Backend", "backend"),