Restrict workspace settings to administrators, add demo countries, Helm chart and instance event log

Employees keep schedule editing but can no longer change workspace preferences or existing
scheduling-directory entries (enforced by the server, hidden in the UI). Demo accounts live in
Cyprus, the United Kingdom and Armenia with matching bank holidays. A Helm chart deploys the
service with a pre-upgrade migrate hook. Refused SSO sign-ins are stored with their support
reference as instance events and searchable on the instance administration page.

Co-Authored-By: Claude <noreply@anthropic.com>

tests/oidc.rs

@@ -316,6 +316,33 @@ workspaces:
         "no_access",
     );
     assert_eq!(reference.len(), 8);
+    // The reference on the screen leads an administrator to the stored reason and the groups
+    // the provider actually sent; ordinary users cannot read the event log.
+    let found: Value = h
+        .client
+        .get(format!("{base}/api/admin/events?search={reference}"))
+        .header("cookie", format!("meguri_session={admin_token}"))
+        .send()
+        .await
+        .unwrap()
+        .json()
+        .await
+        .unwrap();
+    assert_eq!(found["events"].as_array().unwrap().len(), 1);
+    let event = &found["events"][0];
+    assert_eq!(event["action"], "login.failed");
+    assert_eq!(event["details"]["reference"], reference);
+    assert_eq!(event["details"]["code"], "no_access");
+    assert_eq!(event["details"]["subject"], "u-4");
+    assert_eq!(event["details"]["groups"], json!(["/unknown"]));
+    let denied = h
+        .client
+        .get(format!("{base}/api/admin/events"))
+        .header("cookie", format!("meguri_session={token}"))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(denied.status(), StatusCode::FORBIDDEN);
     h.refused(
         &h.attempt(Scenario::new(
             json!({"sub":"u-5","preferred_username":"nogroups"}),