Add OIDC sign-in, group-derived roles and declarative instance configuration

Workspaces, group mappings and sign-in methods now come from a configuration
file synchronized at startup; workspaces dropped from it are disabled, never
deleted. Instance administrators (a new role) see and help every workspace and
may delete disabled ones; workspace administrators and employees are derived
from the user's groups at every SSO sign-in or administrator edit, and the
employee permission set belongs to the workspace. Self-registration is gone:
users come from SSO (only when their groups map) or from the administrator.
Break-glass bootstrap accounts get an HMAC-derived hourly password that all
replicas agree on. First SSO sign-in links a matching email contact to the
user. The demo runs on the same model with a generated per-start password.

Co-Authored-By: Claude <noreply@anthropic.com>

README.md

@@ -10,13 +10,13 @@ On Windows with the PostgreSQL server binaries installed:
 ./scripts/dev.ps1
 ```
 
-Open http://127.0.0.1:3000. Explicit demo accounts: `alice`, `bob`, `carol`; password `meguri-demo-only`. Stop with `./scripts/stop-dev.ps1`. Pass `-PostgresBin PATH` if PostgreSQL is elsewhere. Local data and logs live in ignored `target/local/`.
+Open http://127.0.0.1:3000. The script starts disposable demo mode: accounts `admin` (instance administrator), `alice` (administrator of the demo workspaces) and `bob`, `carol`, `dave`, `erin` (employees) share one password that is generated on every start and shown on the login screen and in `target/local/app.log`. Stop with `./scripts/stop-dev.ps1`. Pass `-PostgresBin PATH` if PostgreSQL is elsewhere. Local data and logs live in ignored `target/local/`.
 
-On other platforms, create a PostgreSQL database, set the environment variables in `.env.example`, then run `cargo run --locked`. Use `postgresql://` URLs. Enable `MEGURI_ALLOW_SIGNUP=true` to create accounts; `MEGURI_SEED_DEMO=true` works only on loopback. Environment files are not automatically loaded.
+On other platforms, create a PostgreSQL database, set the environment variables in `.env.example`, then run `cargo run --locked`. Use `postgresql://` URLs. `MEGURI_SEED_DEMO=true` starts the disposable demo and works only on loopback. Any other run needs an instance configuration file (`MEGURI_CONFIG_FILE`, see [`deploy/instance-config.example.yaml`](deploy/instance-config.example.yaml)); without it startup fails. Environment files are not automatically loaded.
 
 ## Implemented
 
-- Independent workspaces, local accounts, granular workspace grants, and durable audit/history.
+- Independent workspaces declared in an instance configuration file, OpenID Connect sign-in with group-to-role mapping (instance administrator, workspace administrator, employee), optional password and bootstrap accounts, and durable audit/history.
 - Calendar-day rotations with IANA timezones, ordered participants, anchors, absence fallback, holidays, and escalation backup schedules.
 - Replacements and atomic reciprocal swaps; confirmation by the other employee or forced application with a reason.
 - Durable publication, optimistic revisions, worker leases, retries, checkpoints, external drift protection, and a downloadable preview.
@@ -30,15 +30,15 @@ Start with [AGENTS.md](AGENTS.md). Describe intended behavior and examples to th
 cargo fmt --check
 cargo clippy --all-targets -- -D warnings
 cargo test
-cargo test --test integration -- --ignored --test-threads=1
+cargo test --locked --tests -- --ignored --test-threads=1
 ```
 
-The integration command requires `MEGURI_TEST_DATABASE_URL` for a disposable PostgreSQL database. CI runs it explicitly; ordinary unit tests need no database or external account. Browser checks are in `tests/browser.cjs`.
+The ignored suites require `MEGURI_TEST_DATABASE_URL` for a disposable PostgreSQL database whose user may create databases. CI runs them explicitly; ordinary unit tests need no database or external account. Browser checks (`npm run test:browser`) run against a freshly started demo.
 
 ## Current boundaries
 
-OIDC identity linking has a schema boundary but no login adapter yet. JSM has local HTTP contract coverage and still needs acceptance testing against a dedicated JSM test team and your subscription. GKE manifests are deployment templates, not an already deployed environment. No alert ingestion or notification engine is included.
+Sign-in is OpenID Connect (code flow with PKCE) and was tested against a fake provider only; verify your Keycloak client and group mapper as described in [deployment](docs/deployment.md#single-sign-on-with-keycloak) before relying on it. There is no self-registration and no in-app workspace creation. JSM has local HTTP contract coverage and still needs acceptance testing against a dedicated JSM test team and your subscription. GKE manifests are deployment templates, not an already deployed environment. No alert ingestion or notification engine is included.
 
 The ignored `opsgenie-master/` directory is local reference material. Its behavioral examples are captured in the product contract and tests; application and CI do not depend on it.
 
-Demo mode is disposable: `MEGURI_SEED_DEMO=true` resets only positively marked demo data on restart and expires temporary resources while running. Unmarked/normal databases are protected and trigger an isolated demo database with a permanent warning. See [demo lifecycle and retention settings](docs/development.md#demo-lifecycle). Alice leads two generated examples; Bob demonstrates Engineering on-call, Carol daily Support shifts. All use `meguri-demo-only`.
+Demo mode is disposable: `MEGURI_SEED_DEMO=true` resets only positively marked demo data on restart and expires temporary resources while running. Unmarked/normal databases are protected and trigger an isolated demo database with a permanent warning. See [demo lifecycle and retention settings](docs/development.md#demo-lifecycle). Alice administers four generated examples; Bob demonstrates Engineering on-call, Carol daily Support shifts.