fix: oauth2-proxy config and disable CF proxy for staging wildcard

- Update oauth2-proxy with working GitHub OAuth config
- Add OAUTH2_PROXY_SCOPE=user for proper user info retrieval
- Add OAUTH2_PROXY_UPSTREAMS to proxy staging traffic
- Route staging.domain through oauth2-proxy
- Set *.staging DNS to non-proxied for Let's Encrypt SSL

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

main.tf

@@ -238,7 +238,7 @@ resource "cloudflare_record" "staging_wildcard" {
   name    = "*.staging"
   content = hcloud_server.prod.ipv4_address
   type    = "A"
-  proxied = true
+  proxied = false
 }
 
 resource "cloudflare_record" "source" {