Restrict workspace settings to administrators, add demo countries, Helm chart and instance event log

Employees keep schedule editing but can no longer change workspace preferences or existing
scheduling-directory entries (enforced by the server, hidden in the UI). Demo accounts live in
Cyprus, the United Kingdom and Armenia with matching bank holidays. A Helm chart deploys the
service with a pre-upgrade migrate hook. Refused SSO sign-ins are stored with their support
reference as instance events and searchable on the instance administration page.

Co-Authored-By: Claude <noreply@anthropic.com>

src/identity.rs

@@ -680,7 +680,14 @@ pub async fn sso_sign_in(db: &Store, config: &Config, profile: SsoProfile) -> Re
             if resolve_access(config, &profile.groups, false).is_empty() {
                 return Ok(SsoOutcome::NoAccess);
             }
-            create_sso_user(db, &profile).await?
+            let created = create_sso_user(db, &profile).await?;
+            db.instance_event(
+                None,
+                "user.created",
+                json!({"user_id":created,"sso":true,"subject":profile.subject,"email":profile.email,"groups":profile.groups}),
+            )
+            .await?;
+            created
         }
     };
     let id = store::uuid(&user_id)?;