Add OIDC sign-in, group-derived roles and declarative instance configuration

Workspaces, group mappings and sign-in methods now come from a configuration
file synchronized at startup; workspaces dropped from it are disabled, never
deleted. Instance administrators (a new role) see and help every workspace and
may delete disabled ones; workspace administrators and employees are derived
from the user's groups at every SSO sign-in or administrator edit, and the
employee permission set belongs to the workspace. Self-registration is gone:
users come from SSO (only when their groups map) or from the administrator.
Break-glass bootstrap accounts get an HMAC-derived hourly password that all
replicas agree on. First SSO sign-in links a matching email contact to the
user. The demo runs on the same model with a generated per-start password.

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/check.yml

@@ -37,7 +37,7 @@ jobs:
       - run: cargo fmt --check
       - run: cargo clippy --locked --all-targets -- -D warnings
       - run: cargo test --locked
-      - run: cargo test --locked --test integration -- --ignored --test-threads=1
+      - run: cargo test --locked --tests -- --ignored --test-threads=1
       - uses: actions/setup-node@v4
         with:
           node-version: 22
@@ -48,7 +48,7 @@ jobs:
         env:
           DATABASE_URL: postgresql://postgres:test-only@postgres:5432/meguri_test
           MEGURI_SEED_DEMO: "true"
-          MEGURI_ALLOW_SIGNUP: "true"
+          MEGURI_DEMO_SANDBOXES: "12"
           MEGURI_BROWSER_CHANNEL: chromium
         run: |
           cargo build --locked