Add OIDC sign-in, group-derived roles and declarative instance configuration

Workspaces, group mappings and sign-in methods now come from a configuration
file synchronized at startup; workspaces dropped from it are disabled, never
deleted. Instance administrators (a new role) see and help every workspace and
may delete disabled ones; workspace administrators and employees are derived
from the user's groups at every SSO sign-in or administrator edit, and the
employee permission set belongs to the workspace. Self-registration is gone:
users come from SSO (only when their groups map) or from the administrator.
Break-glass bootstrap accounts get an HMAC-derived hourly password that all
replicas agree on. First SSO sign-in links a matching email contact to the
user. The demo runs on the same model with a generated per-start password.

Co-Authored-By: Claude <noreply@anthropic.com>

deploy/gke.yaml

@@ -9,6 +9,71 @@ metadata:
 ---
 apiVersion: v1
 kind: ConfigMap
+metadata:
+  name: meguri-instance-config
+data:
+  # Declarative instance configuration (see deploy/instance-config.example.yaml for the commented
+  # reference and docs/deployment.md). Replace the placeholders. The migrate Job synchronizes it;
+  # replicas only read it. Change it, run the migrate Job for the release, then restart replicas.
+  config.yaml: |
+    auth:
+      # Lets ordinary password accounts (created by an instance administrator) sign in.
+      # Keep false in production where everyone signs in through SSO.
+      password_login: false
+
+      # Break-glass instance administrators. Omit this whole block in production; add it only to get
+      # back in when SSO is broken, then remove it again. While present, the generated password is
+      # written to the log of the process that synchronized the configuration (the migrate Job), and
+      # anyone who can read that log can sign in as an instance administrator. The password is derived
+      # from a database-held secret, the username and the current UTC hour; it rotates every hour.
+      # bootstrap_admin:
+      #   usernames: [rescue]
+
+    # OpenID Connect provider. Confidential client, authorization-code flow with PKCE.
+    # Redirect URI to register: {MEGURI_PUBLIC_URL}/api/oidc/callback
+    oidc:
+      issuer: https://sso.example.internal/realms/corp   # HTTPS; discovery is read from <issuer>/.well-known/openid-configuration
+      client_id: meguri
+      scopes: [openid, profile, email]                   # default; must include openid; email links people planned by email
+      # Where the groups are. A dotted path into the token claims (for example realm_access.roles).
+      # Keycloak: add a "Group Membership" mapper with this claim name, "Add to ID token" and
+      # "Add to userinfo" on. Matching below is by exact string, so "Full group path" decides
+      # whether values look like /payments/leads or leads.
+      groups_claim: groups
+      groups_sources: [id_token, userinfo]               # searched in this order
+
+    # Groups whose members are instance administrators: they see and may act in every enabled
+    # workspace, manage password users and delete disabled workspaces. Not tied to any workspace.
+    instance_admin_groups:
+      - /meguri/admins
+
+    # Workspaces. `key` is the permanent identifier (3-64 characters: a-z, 0-9, hyphen); never reuse
+    # it for something else. `name` is unique and is what people see; changing it renames the
+    # workspace. A workspace that exists without a key and has exactly this name is adopted.
+    # Removing an entry here DISABLES the workspace (nobody can open it, nothing is published, data is
+    # kept); listing it again re-enables it. Deleting it for good is a manual action on the
+    # instance administrator's page.
+    workspaces:
+      - key: payments
+        name: Payments
+        # Workspace administrators (team leads): every permission in this workspace only. At least one group.
+        admin_groups:
+          - /payments/leads
+        # Employees: the workspace's employee permission set, by default calendar, schedule editing
+        # and replacement requests. Administrators change that set in the workspace settings.
+        member_groups:
+          - /payments/team
+
+      - key: customer-support
+        name: Customer Support
+        admin_groups:
+          - /support/leads
+        member_groups:
+          - /support/team
+          - /support/contractors
+---
+apiVersion: v1
+kind: ConfigMap
 metadata:
   name: meguri-config
 data:
@@ -16,7 +81,7 @@ data:
   MEGURI_PUBLIC_URL: https://meguri.example.internal
   MEGURI_ROLE: all
   MEGURI_SKIP_MIGRATIONS: "true"
-  MEGURI_ALLOW_SIGNUP: "false"
+  MEGURI_CONFIG_FILE: /etc/meguri/config.yaml
   MEGURI_SEED_DEMO: "false"
   RUST_LOG: meguri=info,cot=warn
 ---
@@ -52,6 +117,9 @@ spec:
             httpGet: {path: /startup, port: 9090}
             periodSeconds: 2
             failureThreshold: 30
+      volumes:
+        - name: instance-config
+          configMap: {name: meguri-instance-config}
       containers:
         - name: meguri
           image: REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/meguri:RELEASE
@@ -59,6 +127,12 @@ spec:
           envFrom:
             - configMapRef: {name: meguri-config}
             - secretRef: {name: meguri-secrets}
+          env:
+            - name: MEGURI_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef: {name: meguri-secrets, key: MEGURI_OIDC_CLIENT_SECRET, optional: true}
+          volumeMounts:
+            - {name: instance-config, mountPath: /etc/meguri, readOnly: true}
           securityContext:
             readOnlyRootFilesystem: true
             allowPrivilegeEscalation: false