geniusrund: construct the OIDC verifier and require its config at startup

backend/cmd/geniusrund/main.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"geniusrun/backend/internal/api"
+	"geniusrun/backend/internal/auth"
 	"geniusrun/backend/internal/config"
 	"geniusrun/backend/internal/garmin"
 	"geniusrun/backend/internal/store"
@@ -48,7 +49,22 @@ func main() {
 		MinConfidence: cfg.MinConfidence,
 	}, nil)
 
-	server := api.NewServer(db, garminClient, syncSvc)
+	authVerifier, err := auth.NewOIDCVerifier(context.Background(), auth.OIDCConfig{
+		IssuerURL:    cfg.OIDCIssuerURL,
+		ClientID:     cfg.OIDCClientID,
+		ClientSecret: cfg.OIDCClientSecret,
+		RedirectURL:  cfg.OIDCRedirectURL,
+		RequiredRole: cfg.OIDCRequiredRole,
+	})
+	if err != nil {
+		log.Fatalf("oidc: %v", err)
+	}
+
+	server := api.NewServer(db, garminClient, syncSvc, authVerifier, api.SessionConfig{
+		Secret:   cfg.SessionSecret,
+		Duration: cfg.SessionDuration,
+		Secure:   cfg.SessionSecure,
+	})
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()