Restrict workspace settings to administrators, add demo countries, Helm chart and instance event log

Employees keep schedule editing but can no longer change workspace preferences or existing
scheduling-directory entries (enforced by the server, hidden in the UI). Demo accounts live in
Cyprus, the United Kingdom and Armenia with matching bank holidays. A Helm chart deploys the
service with a pre-upgrade migrate hook. Refused SSO sign-ins are stored with their support
reference as instance events and searchable on the instance administration page.

Co-Authored-By: Claude <noreply@anthropic.com>

static/index.html

@@ -161,6 +161,29 @@
 </div>
 </template>
 </div>
+<div class="section-line"><h2><span x-text="t('access_events_title')"></span></h2></div>
+<article class="panel rule-card spaced" id="instance-events">
+<p class="muted"><span x-text="t('access_events_note')"></span></p>
+<form class="event-search" @submit.prevent="run(()=>loadEvents())">
+<input type="search" x-model="eventSearch" maxlength="200" :aria-label="t('access_events_search_label')" :placeholder="t('access_events_search_placeholder')">
+<button class="primary" :disabled="busy"><span x-text="t('access_events_search')"></span></button>
+<button type="button" :disabled="busy" @click="run(()=>loadEvents())"><span x-text="t('access_events_refresh')"></span></button>
+</form>
+<p class="muted padded" data-events-empty x-show="!events.length && !eventsLoading"><span x-text="t('access_events_empty')"></span></p>
+<div class="event-list">
+<template x-for="e in events" :key="e.id">
+<div class="event-row" :class="{failed:isFailedLogin(e)}" :data-event-action="e.action">
+<div class="event-head"><code class="event-action" :class="{failed:isFailedLogin(e)}" x-text="e.action"></code><span class="event-actor" x-text="e.actor || t('access_event_system')"></span><small class="event-time" x-text="formatTime(e.created_at)"></small></div>
+<dl class="event-details">
+<template x-for="d in eventDetails(e)" :key="d.key">
+<div><dt x-text="eventLabel(d.key)"></dt><dd><template x-if="d.chips"><span class="chips"><template x-for="chip in d.chips" :key="chip"><code class="chip" x-text="chip"></code></template><small class="muted" x-show="d.empty" x-text="t('access_user_no_groups')"></small></span></template><template x-if="!d.chips"><span x-text="d.value"></span></template></dd></div>
+</template>
+</dl>
+</div>
+</template>
+</div>
+<p class="info-note" data-events-more x-show="eventsMore"><span x-text="t('access_events_more')"></span></p>
+</article>
 <div class="section-line"><h2><span x-text="t('access_users_title')"></span></h2>
 <button class="primary" @click="open('admin-user')"><span x-text="t('access_add_user')"></span></button>
 </div>