#41 fix(config): read nested options such as OIDC__CLIENT_ID from environment variables

The server ignored nested environment variables such as OIDC__PROVIDER_URL. The environment source had no separator, so OIDC could only be configured in config.toml.

• Nested options now use __ as the separator. OIDC__CLIENT_ID sets client_id in [oidc]. Flat variables such as SECRET_KEY and TRUSTED_PROXY_HOPS work as before.
• allowed_redirect_urls also accepts a comma-separated string, so OIDC__ALLOWED_REDIRECT_URLS=myapp://oidc,https://app.example.com/oidc works. Without it, an environment-only OIDC setup can't log anyone in, because the server refuses OIDC login while that list is empty.
• The README explains the separator and the list format.
• RateLimiter::check now notes that failed attempts count toward the limit on purpose. If they didn't, password guessing would be unlimited.

Proof: a new unit test sets OIDC__* variables. It failed before the change ("OIDC__* variables should set oidc") and passes now. A second test checks that an environment variable overrides one option of a config.toml section. cargo fmt, cargo clippy -D warnings and cargo test pass.

Reviewed with sol-loop: 1 round with gpt-6.1-sol on high.
Sol verdict: approved

Changes made by Claude Opus 5.5 in Claude Code (T3 Code).