fix(oidc): reject an unrecognized boolean instead of guessing

_env_bool returned the default for anything outside {true,1,yes}, so
BAMBUDDY_OIDC_REQUIRE_EMAIL_VERIFIED=on silently read as OFF and
BAMBUDDY_OIDC_ENABLED=on silently disabled the provider -- the exact
opposite of what .env.example claimed. Unrecognized values now raise
EnvOIDCConfigError, caught in _apply_env_oidc_provider the same way a
bad DEFAULT_GROUP or a ValidationError already is: logged and left
running, never released on a typo.

Also promotes _env_bool to env_bool now that it has a call site in
auth.py, and corrects the boolean-parsing sentence in .env.example.

.env.example

@@ -100,7 +100,8 @@ LOG_TO_FILE=true
 # BAMBUDDY_OIDC_AUTOLOGIN=false
 # BAMBUDDY_OIDC_DEFAULT_GROUP=
 #
-# Booleans accept true/1/yes; anything else keeps the default.
+# Booleans accept true/1/yes or false/0/no (case-insensitive). Blank or unset
+# uses the default; any other value is rejected and the provider is skipped.
 #
 # DEFAULT_GROUP is the group new users land in when AUTO_CREATE_USERS is on;
 # without it they get Viewers. It matches a group NAME exactly (case-sensitive)