fix auth exposure and release workflows

[phenix3443]

Summary

• hide unsupported or incompletely configured auth methods from the public global config response, and reject disabled or incomplete OAuth login requests
• avoid blocking server startup when the GeoIP database is missing by continuing without GeoIP support
• update GitHub Actions to use newer checkout/login actions, publish release images to GHCR, and trigger the matching ppanel packaging workflow after releases

Validation

• no additional local validation was run for this metadata update

[web-ppanel]

Thanks for the contribution! The code changes here are solid, but this PR mixes several unrelated concerns:

1. OAuth config validation + Telegram Redis key fix
2. GeoIP non-blocking startup
3. Release workflow migration from Docker Hub → GHCR
4. AI tooling files (AGENT.md, CLAUDE.md, BRANCH_STRATEGY.md, CONTRIBUTING.md)

Could you please split these into separate PRs so we can review and merge them individually? The workflow/registry change in particular is a breaking change for existing users and needs to be evaluated separately.

Closing for now — please reopen individual PRs for each concern.