Add OIDC sign-in, group-derived roles and declarative instance configuration

Workspaces, group mappings and sign-in methods now come from a configuration
file synchronized at startup; workspaces dropped from it are disabled, never
deleted. Instance administrators (a new role) see and help every workspace and
may delete disabled ones; workspace administrators and employees are derived
from the user's groups at every SSO sign-in or administrator edit, and the
employee permission set belongs to the workspace. Self-registration is gone:
users come from SSO (only when their groups map) or from the administrator.
Break-glass bootstrap accounts get an HMAC-derived hourly password that all
replicas agree on. First SSO sign-in links a matching email contact to the
user. The demo runs on the same model with a generated per-start password.

Co-Authored-By: Claude <noreply@anthropic.com>

.env.example

@@ -2,8 +2,17 @@ DATABASE_URL=postgresql://meguri:change-me@127.0.0.1:5432/meguri
 MEGURI_BIND=127.0.0.1:3000
 MEGURI_PUBLIC_URL=http://127.0.0.1:3000
 MEGURI_ROLE=all
-MEGURI_ALLOW_SIGNUP=false
+# Instance configuration: workspaces, group mappings and sign-in methods. Required to start,
+# except in demo mode (MEGURI_SEED_DEMO=true), which uses a built-in configuration and ignores this.
+# See deploy/instance-config.example.yaml.
+MEGURI_CONFIG_FILE=/etc/meguri/config.yaml
+# Deployment secret of the confidential OIDC client; required when the configuration has an oidc block.
+# MEGURI_OIDC_CLIENT_SECRET=from-your-secret-manager
+# Allows a configuration without workspaces to disable every existing workspace (normally refused).
+# MEGURI_ALLOW_DISABLE_ALL=false
 MEGURI_SEED_DEMO=false
+# Demo only: adds n empty "Sandbox" workspaces for automated browser checks (0-20).
+# MEGURI_DEMO_SANDBOXES=0
 # Optional separately provisioned empty demo database. Protected databases are never reset.
 # MEGURI_DEMO_DATABASE_URL=postgresql://demo:change-me@127.0.0.1:5432/meguri_demo
 MEGURI_DEMO_WORKSPACE_TTL_SECONDS=86400