Add OIDC sign-in, group-derived roles and declarative instance configuration

Workspaces, group mappings and sign-in methods now come from a configuration
file synchronized at startup; workspaces dropped from it are disabled, never
deleted. Instance administrators (a new role) see and help every workspace and
may delete disabled ones; workspace administrators and employees are derived
from the user's groups at every SSO sign-in or administrator edit, and the
employee permission set belongs to the workspace. Self-registration is gone:
users come from SSO (only when their groups map) or from the administrator.
Break-glass bootstrap accounts get an HMAC-derived hourly password that all
replicas agree on. First SSO sign-in links a matching email contact to the
user. The demo runs on the same model with a generated per-start password.

Co-Authored-By: Claude <noreply@anthropic.com>

src/migrations.rs

@@ -6,6 +6,7 @@ pub mod m_0005_variables;
 pub mod m_0006_demo_lifecycle;
 pub mod m_0007_language;
 pub mod m_0008_workspaces;
+pub mod m_0009_access;
 pub const MIGRATIONS: &[&cot::db::migrations::SyncDynMigration] = &[
     &m_0001_initial::Migration,
     &m_0002_constraints::Migration,
@@ -15,4 +16,5 @@ pub const MIGRATIONS: &[&cot::db::migrations::SyncDynMigration] = &[
     &m_0006_demo_lifecycle::Migration,
     &m_0007_language::Migration,
     &m_0008_workspaces::Migration,
+    &m_0009_access::Migration,
 ];