Add OIDC sign-in, group-derived roles and declarative instance configuration

Workspaces, group mappings and sign-in methods now come from a configuration
file synchronized at startup; workspaces dropped from it are disabled, never
deleted. Instance administrators (a new role) see and help every workspace and
may delete disabled ones; workspace administrators and employees are derived
from the user's groups at every SSO sign-in or administrator edit, and the
employee permission set belongs to the workspace. Self-registration is gone:
users come from SSO (only when their groups map) or from the administrator.
Break-glass bootstrap accounts get an HMAC-derived hourly password that all
replicas agree on. First SSO sign-in links a matching email contact to the
user. The demo runs on the same model with a generated per-start password.

Co-Authored-By: Claude <noreply@anthropic.com>

tests/generation.rs

@@ -121,6 +121,7 @@ fn priority_skips_absence_country_holidays_then_uses_effective_fallback() {
         email: None,
         display_name: "Person".into(),
         country: Some(if id == e.people[0] { "CY" } else { "AM" }.into()),
+        aliases: vec![],
     }));
     doc.holidays.push(Holiday {
         country: "CY".into(),
@@ -168,6 +169,7 @@ fn priority_skips_absence_country_holidays_then_uses_effective_fallback() {
         email: Some("cover@example.com".into()),
         display_name: "Cover".into(),
         country: Some("CY".into()),
+        aliases: vec![],
     });
     doc.requests.push(ReplacementRequest {
         effective_legs: None,