Add OIDC sign-in, group-derived roles and declarative instance configuration

Workspaces, group mappings and sign-in methods now come from a configuration
file synchronized at startup; workspaces dropped from it are disabled, never
deleted. Instance administrators (a new role) see and help every workspace and
may delete disabled ones; workspace administrators and employees are derived
from the user's groups at every SSO sign-in or administrator edit, and the
employee permission set belongs to the workspace. Self-registration is gone:
users come from SSO (only when their groups map) or from the administrator.
Break-glass bootstrap accounts get an HMAC-derived hourly password that all
replicas agree on. First SSO sign-in links a matching email contact to the
user. The demo runs on the same model with a generated per-start password.

Co-Authored-By: Claude <noreply@anthropic.com>

deploy/migrate.yaml

@@ -28,6 +28,9 @@ spec:
             httpGet: {path: /startup, port: 9090}
             periodSeconds: 2
             failureThreshold: 30
+      volumes:
+        - name: instance-config
+          configMap: {name: meguri-instance-config}
       containers:
         - name: migrate
           image: REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/meguri:RELEASE
@@ -37,6 +40,11 @@ spec:
           env:
             - {name: MEGURI_ROLE, value: migrate}
             - {name: MEGURI_SKIP_MIGRATIONS, value: "false"}
+            - name: MEGURI_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef: {name: meguri-secrets, key: MEGURI_OIDC_CLIENT_SECRET, optional: true}
+          volumeMounts:
+            - {name: instance-config, mountPath: /etc/meguri, readOnly: true}
           securityContext:
             readOnlyRootFilesystem: true
             allowPrivilegeEscalation: false