config: only require the OIDC client secret for serve

[joshsol1]

Summary

Config::load exited with [oidc] is configured but no client_secret was provided for every subcommand, including add-admin, list-admins and map-group. That secret lives in /opt/rustguac/env, which only systemd's EnvironmentFile= loads, so running the admin CLI from a shell failed until the secret was also in the config.toml file.

This change keeps the OIDC_CLIENT_SECRET override in Config::load, but moves the presence check into a new Config::validate_oidc_secret() that returns a Result, and calls it only on the serve path. Admin subcommands only touch the SQLite database and never contact the IdP, so they no longer need the secret.

Changes

• src/config.rs: Config::load no longer exits on a missing OIDC secret; new validate_oidc_secret() carries the same operator-facing message. Four unit tests added.
• src/main.rs: serve runs the validation before starting; other subcommands skip it.

Testing

Built an unpatched and a patched binary and ran both against a throwaway config with an [oidc] block and no client_secret:

Scenario	Before	After
add-admin, no secret in env	exit 1 with the error	admin created
list-admins, no secret in env	exit 1 with the error	lists admins
serve, no secret	exit 1 with the error	exit 1 with the error (unchanged)
serve, secret sourced from env file	starts	starts

Also cargo fmt --check, cargo clippy -- -D warnings and cargo test (310 passed) are clean.