fix: restore authentication restrictions link in settings

[KutiFF]

Fixes #645.

The Authentication Restrictions link could disappear after restarting Headplane. This change checks Headscale's OIDC configuration instead of Headplane's discovery status, so the link stays visible.

Includes regression tests and a changelog entry.

[pullfrog]

✅ No new issues found.

Reviewed changes

• Restrictions link decoupled from Headplane discovery — app/routes/settings/overview.tsx now derives hasOidcConfig from headscaleConfig.hasOIDCConfig() instead of oidcContext, so the link no longer depends on Headplane's OIDC discovery reaching ready after a restart.
• Consistent with the target page — the same hasOIDCConfig()/getOIDCConfig() path gates the restrictions route's loader (which throws 501 when OIDC is unconfigured), so the link cannot surface a page that fails to load.
• Regression tests — tests/unit/settings/overview.test.ts covers the link for Headplane OIDC states pending/disabled/ready, plus hidden when Headscale has no OIDC config and when the config is not writable. The oidcContext mock acts as a tripwire: reverting to the old condition would fail the pending/disabled cases. Ran pnpm vitest run --project unit tests/unit/settings/overview.test.ts — 5 passed.
• Changelog — Fixes entry under # Next closes #645.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}