Add OIDC sign-in, group-derived roles and declarative instance configuration

Workspaces, group mappings and sign-in methods now come from a configuration
file synchronized at startup; workspaces dropped from it are disabled, never
deleted. Instance administrators (a new role) see and help every workspace and
may delete disabled ones; workspace administrators and employees are derived
from the user's groups at every SSO sign-in or administrator edit, and the
employee permission set belongs to the workspace. Self-registration is gone:
users come from SSO (only when their groups map) or from the administrator.
Break-glass bootstrap accounts get an HMAC-derived hourly password that all
replicas agree on. First SSO sign-in links a matching email contact to the
user. The demo runs on the same model with a generated per-start password.

Co-Authored-By: Claude <noreply@anthropic.com>

deploy/instance-config.example.yaml

@@ -0,0 +1,63 @@
+# Meguri instance configuration. The process refuses to start without it (MEGURI_CONFIG_FILE).
+# This file is the only place that defines workspaces and which identity-provider groups give
+# which role; there is no UI or API for either. The OIDC client secret is NOT stored here: set
+# MEGURI_OIDC_CLIENT_SECRET in the deployment secret store.
+#
+# Applied by the migrate Job (or a single process without MEGURI_SKIP_MIGRATIONS) at every release.
+# Unknown fields and invalid values are rejected at startup.
+
+auth:
+  # Lets ordinary password accounts (created by an instance administrator) sign in.
+  # Keep false in production where everyone signs in through SSO.
+  password_login: false
+
+  # Break-glass instance administrators. Omit this whole block in production; add it only to get
+  # back in when SSO is broken, then remove it again. While present, the generated password is
+  # written to the log of the process that synchronized the configuration (the migrate Job), and
+  # anyone who can read that log can sign in as an instance administrator. The password is derived
+  # from a database-held secret, the username and the current UTC hour; it rotates every hour.
+  # bootstrap_admin:
+  #   usernames: [rescue]
+
+# OpenID Connect provider. Confidential client, authorization-code flow with PKCE.
+# Redirect URI to register: {MEGURI_PUBLIC_URL}/api/oidc/callback
+oidc:
+  issuer: https://sso.example.internal/realms/corp   # HTTPS; discovery is read from <issuer>/.well-known/openid-configuration
+  client_id: meguri
+  scopes: [openid, profile, email]                   # default; must include openid; email links people planned by email
+  # Where the groups are. A dotted path into the token claims (for example realm_access.roles).
+  # Keycloak: add a "Group Membership" mapper with this claim name, "Add to ID token" and
+  # "Add to userinfo" on. Matching below is by exact string, so "Full group path" decides
+  # whether values look like /payments/leads or leads.
+  groups_claim: groups
+  groups_sources: [id_token, userinfo]               # searched in this order
+
+# Groups whose members are instance administrators: they see and may act in every enabled
+# workspace, manage password users and delete disabled workspaces. Not tied to any workspace.
+instance_admin_groups:
+  - /meguri/admins
+
+# Workspaces. `key` is the permanent identifier (3-64 characters: a-z, 0-9, hyphen); never reuse
+# it for something else. `name` is unique and is what people see; changing it renames the
+# workspace. A workspace that exists without a key and has exactly this name is adopted.
+# Removing an entry here DISABLES the workspace (nobody can open it, nothing is published, data is
+# kept); listing it again re-enables it. Deleting it for good is a manual action on the
+# instance administrator's page.
+workspaces:
+  - key: payments
+    name: Payments
+    # Workspace administrators (team leads): every permission in this workspace only. At least one group.
+    admin_groups:
+      - /payments/leads
+    # Employees: the workspace's employee permission set, by default calendar, schedule editing
+    # and replacement requests. Administrators change that set in the workspace settings.
+    member_groups:
+      - /payments/team
+
+  - key: customer-support
+    name: Customer Support
+    admin_groups:
+      - /support/leads
+    member_groups:
+      - /support/team
+      - /support/contractors