OIDC popup flow hangs due to Authentik X-Frame-Options. Keep OIDC accessible via the "Other" tab instead.
Configure Vault to use Authentik as OIDC identity provider for SSO login. Creates OAuth2 provider/application in Authentik, adds OIDC auth backend, admin policy, and maps "authentik Admins" group to full vault-admin access.