Offer «Entrar con Pireon» on the panel's login page

Under the e-mail and password form, a button takes the redirect flow
(Authorization Code + PKCE), so the password is only ever typed at the
identity server. The routes for it were already there; the page had no
way to reach them.

A Pireon client allows one grant type and the panel's is a password
client, so the redirect flow can use its own: PIREON_REDIRECT_CLIENT_ID
and PIREON_REDIRECT_CLIENT_SECRET (the main client when they are empty).
The button shows up once that client is set, or with
PIREON_REDIRECT_LOGIN=true. Each session renews its token with the
client that issued it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/Auth/PireonAuthController.php

@@ -19,6 +19,8 @@ use Illuminate\Support\Facades\Log;
  *
  * The browser never sees a password belonging to this application, and the
  * authorization code alone is useless without the verifier we keep server-side.
+ * It is «Entrar con Pireon» on the login page; it uses the redirect client
+ * (`PireonClient::forRedirect()`), its own one when configured.
  */
 class PireonAuthController extends Controller
 {
@@ -38,7 +40,7 @@ class PireonAuthController extends Controller
         }
 
         try {
-            ['url' => $url, 'state' => $state, 'code_verifier' => $verifier] = $this->client->authorizationUrl();
+            ['url' => $url, 'state' => $state, 'code_verifier' => $verifier] = PireonClient::forRedirect()->authorizationUrl();
         } catch (PireonException $e) {
             return $this->fail($e, route('login'));
         }
@@ -81,7 +83,7 @@ class PireonAuthController extends Controller
         }
 
         try {
-            $token = $this->client->exchangeCode((string) $request->query('code'), (string) $verifier);
+            $token = PireonClient::forRedirect()->exchangeCode((string) $request->query('code'), (string) $verifier);
             $identity = $this->client->identity($token->accessToken);
         } catch (PireonException $e) {
             return $this->fail($e, route('login'));
@@ -100,7 +102,7 @@ class PireonAuthController extends Controller
         $request->session()->regenerate();
 
         Auth::login($user, remember: true);
-        $this->tokens->put($token);
+        $this->tokens->put($token, viaRedirect: true);
 
         if ($user->locale) {
             $request->session()->put(config('locales.session_key'), $user->locale);