Add OIDC sign-in, group-derived roles and declarative instance configuration

Workspaces, group mappings and sign-in methods now come from a configuration
file synchronized at startup; workspaces dropped from it are disabled, never
deleted. Instance administrators (a new role) see and help every workspace and
may delete disabled ones; workspace administrators and employees are derived
from the user's groups at every SSO sign-in or administrator edit, and the
employee permission set belongs to the workspace. Self-registration is gone:
users come from SSO (only when their groups map) or from the administrator.
Break-glass bootstrap accounts get an HMAC-derived hourly password that all
replicas agree on. First SSO sign-in links a matching email contact to the
user. The demo runs on the same model with a generated per-start password.

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/dev.ps1

@@ -40,10 +40,10 @@ Push-Location $repo
 try { cargo build --locked; if ($LASTEXITCODE) { throw 'Build failed' } } finally { Pop-Location }
 $env:MEGURI_BIND = "127.0.0.1:$Port"
 $env:MEGURI_PUBLIC_URL = "http://127.0.0.1:$Port"
-$env:MEGURI_ALLOW_SIGNUP = 'true'
 $env:MEGURI_SEED_DEMO = 'true'
 $env:MEGURI_ROLE = 'all'
 Copy-Item -LiteralPath (Join-Path $repo 'target/debug/meguri.exe') -Destination $appExecutable
 $app = Start-Process -FilePath $appExecutable -WorkingDirectory $repo -WindowStyle Hidden -PassThru -RedirectStandardOutput (Join-Path $localDir 'app.log') -RedirectStandardError (Join-Path $localDir 'app-error.log')
 $app.Id | Set-Content $pidFile
-Write-Output "Meguri starting at $env:MEGURI_PUBLIC_URL — demo: alice / meguri-demo-only"
+Write-Output "Meguri starting at $env:MEGURI_PUBLIC_URL as a disposable demo. Accounts: admin (instance administrator), alice (workspace administrator), bob, carol, dave, erin (employees)."
+Write-Output "One password is generated on every start: it is shown on the login screen and logged in $(Join-Path $localDir 'app.log')."