Offer «Entrar con Pireon» on the panel's login page

Under the e-mail and password form, a button takes the redirect flow
(Authorization Code + PKCE), so the password is only ever typed at the
identity server. The routes for it were already there; the page had no
way to reach them.

A Pireon client allows one grant type and the panel's is a password
client, so the redirect flow can use its own: PIREON_REDIRECT_CLIENT_ID
and PIREON_REDIRECT_CLIENT_SECRET (the main client when they are empty).
The button shows up once that client is set, or with
PIREON_REDIRECT_LOGIN=true. Each session renews its token with the
client that issued it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -76,6 +76,15 @@ PIREON_CLIENT_SECRET=
 PIREON_REDIRECT_URI="${APP_URL}/auth/callback"
 PIREON_SCOPES=account:read
 
+# «Entrar con Pireon» (Authorization Code + PKCE) under the login form. A Pireon
+# client allows one grant type: the one above is the password client, so
+# register another for authorization_code with the redirect URI above and put
+# it here; the button shows up once it is set. PIREON_REDIRECT_LOGIN=true shows
+# it with the client above instead (when that one allows authorization_code).
+PIREON_REDIRECT_CLIENT_ID=
+PIREON_REDIRECT_CLIENT_SECRET=
+# PIREON_REDIRECT_LOGIN=
+
 # Grants. The panel's sign-in form uses the password grant, so turning this off
 # locks everyone out of the panel as well as out of POST /api/v1/auth/token.
 PIREON_PASSWORD_GRANT=true