OIDC config should use authorization code flow, not implicit

[24c02]

The OIDC-only path in hack_club_auth.rb generates:

response_type: :id_token,
response_mode: :form_post

This is the implicit flow, which HCA doesn't appear to support (and is discouraged by the OAuth 2.0 Security BCP regardless). The config should use the standard authorization code flow instead:

response_type: :code

and drop the response_mode: :form_post line (the default redirect response mode works fine with code flow).

🤖 Generated with Claude Code