feat(db): auth_provider_config table + AES-256-GCM encryption helpers

Renumbered migration 0021 → 0023 to resolve conflict with pet_image and
logo_key migrations that landed on main after this branch was created.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/db/src/schema.ts

@@ -135,7 +135,6 @@ export const pets = pgTable("pets", {
   customFields: jsonb("custom_fields").$type<Record<string, string>>().notNull().default({}),
   photoKey: text("photo_key"),
   photoUploadedAt: timestamp("photo_uploaded_at"),
-  image: text("image"),
   createdAt: timestamp("created_at").notNull().defaultNow(),
   updatedAt: timestamp("updated_at").notNull().defaultNow(),
 });
@@ -348,7 +347,6 @@ export const businessSettings = pgTable("business_settings", {
   businessName: text("business_name").notNull().default("GroomBook"),
   logoBase64: text("logo_base64"),
   logoMimeType: text("logo_mime_type"),
-  logoKey: text("logo_key"),
   primaryColor: text("primary_color").notNull().default("#4f8a6f"),
   accentColor: text("accent_color").notNull().default("#8b7355"),
   createdAt: timestamp("created_at").notNull().defaultNow(),
@@ -407,3 +405,19 @@ export const waitlistEntries = pgTable(
     index("idx_waitlist_status").on(t.status),
   ]
 );
+
+// ─── Auth Provider Config ──────────────────────────────────────────────────
+
+export const authProviderConfig = pgTable("auth_provider_config", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  providerId: text("provider_id").notNull().unique(), // e.g. "authentik", "okta", "entra-id"
+  displayName: text("display_name").notNull(), // shown on login button
+  issuerUrl: text("issuer_url").notNull(), // OIDC issuer/discovery URL
+  internalBaseUrl: text("internal_base_url"), // for hairpin NAT / K8s internal routing
+  clientId: text("client_id").notNull(),
+  clientSecret: text("client_secret").notNull(), // AES-256-GCM encrypted using BETTER_AUTH_SECRET
+  scopes: text("scopes").notNull().default("openid profile email"),
+  enabled: boolean("enabled").notNull().default(true),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});