chore(release): 0.12.3

[pratyush618]

Bumps every workspace manifest to 0.12.3 and adds the changelog entry covering everything since 0.12.2 — most prominently the dashboard SSO (Google / GitHub / generic OIDC) work that landed via #168.

What's in 0.12.3

Added

• Dashboard SSO (OAuth & OIDC) — Google, GitHub, multi-slot generic OIDC. PKCE, single-use state, nonce-verified ID tokens, allowlists by Workspace domain / GitHub org / OIDC email domain. Configurable via env vars; password login still works alongside.
• Operator setup guide for SSO with a Mermaid sequence diagram of the flow.

Changed

• Dashboard docs moved into their own top-level Guides section (was buried under Observability).

Fixed

• WebhookManager daemon-thread leak on every Queue() (CI thread-limit panic on macOS).
• EncryptedSerializer.loads blanket except Exception narrowed to InvalidTag; programmer errors now propagate.

Internal

• HttpClient Protocol so providers accept any duck-typed session — no more # type: ignore[arg-type] at the test boundary.
• CI installs the oauth extra so dashboard tests can import authlib / joserfc / requests.
• Cross-version mypy compatibility on the joserfc KeySet.import_key_set call.

Test plan

• cargo check --workspace — clean
• uv run python -m pytest tests/dashboard/ — 263 passed
• uv run python -m pytest tests/core/test_serializers.py — 16 passed, 2 skipped (msgpack not installed locally)
• uv run ruff check py_src/ tests/ — clean
• uv run mypy py_src/taskito/ tests/ — clean (238 source files)
• pnpm --dir docs types:check — clean
• pnpm --dir docs lint — clean

After merge, publish via the existing GitHub Releases flow.