Add OIDC login and per-domain authorization

Authentication previously implied full authorization: any valid token
could manage every host, DNS provider, domain, and user. This adds SSO
login and a per-domain rights model.

OIDC login (authorization_code + PKCE):
- conf.oidc + conf.auth blocks; clientSecret in (gitignored) secrets.js.
- utils/oidc.js (state/PKCE, code exchange, userinfo) using global fetch.
- models/oidc_state.js: short-lived state store, auto-expiring via
  model-redis 1.5 per-key TTL.
- routes/auth.js: GET /auth/oidc/start + /auth/oidc/callback; JIT-provisions
  a local user, mints an AuthToken carrying the SSO groups, hands the token to
  the browser via a URL fragment. "Log in with SSO" button on the login page.

Authorization (groups + app overrides, per-domain, with ownership):
- models/grant.js + utils/roles.js (pure, unit-tested): effective rights from
  conf.auth (admin users/groups, group->role map), Grant records
  (user|group -> global|domain -> viewer|manager|admin), and ownership
  (created_by). Roles rank admin > manager(owner) > viewer.
- AuthToken stores session groups; middleware/auth.js exposes req.groups.
- middleware/authz.js: requireAdmin, requireDomainRole(minRole, resolveDomain),
  filterViewable. Applied across routes: host mutations need manager on the
  host's domain; reads are filtered to visible domains; DNS providers, user
  management, and grant management are global-admin-only; certs need viewer.
- routes/grant.js: admin CRUD for grants. Anti-lockout via conf.auth.adminUsers
  plus migrations/grant_bootstrap.js.

Frontend: /me returns effective rights; nav gates Users/Grants to admins;
grants management page; OIDC token-fragment handling in app-base.js.

Tests: utils/roles and utils/oidc unit-tested (no redis); wired into the test
scripts. Full suite 89 pass. Also verified end-to-end against redis (grant
resolution, middleware allow/deny/403, list filtering) and the OIDC pure flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/conf/base.js

@@ -22,6 +22,40 @@ module.exports = {
 	// self-correct. 0 disables expiry (entries live until bustCache/clearCache).
 	cacheTTL: 3600,
 
+	// OpenID Connect login against the SSO. Endpoints come from the SSO's
+	// /.well-known/openid-configuration. clientSecret lives in secrets.js.
+	// redirectUri MUST be registered on the SSO client and match exactly.
+	oidc: {
+		enabled: true,
+		issuer: 'https://sso.theta42.com',
+		authorizationEndpoint: 'https://sso.theta42.com/oauth/authorize',
+		tokenEndpoint: 'https://sso.theta42.com/oauth/token',
+		userinfoEndpoint: 'https://sso.theta42.com/oauth/userinfo',
+		endSessionEndpoint: 'https://sso.theta42.com/oauth/logout',
+		clientId: '__SET_ME__',
+		// Where the SSO sends the user back. Must be an absolute URL reachable
+		// by the browser and registered on the SSO client.
+		redirectUri: 'http://localhost:3000/api/auth/oidc/callback',
+		scopes: ['openid', 'profile', 'email', 'groups'],
+		// Claim on the userinfo response that carries group membership.
+		groupsClaim: 'groups',
+		// Claim used as the local username.
+		usernameClaim: 'preferred_username',
+	},
+
+	// Authorization: how groups map to roles, and which groups are global admin.
+	// Per-user overrides are Grant records managed in the app.
+	auth: {
+		// Members of these SSO/LDAP groups are always global admins.
+		adminGroups: [],
+		// Optional default role mapping for groups, e.g.
+		//   { 'dns-team': { role: 'manager', scope: 'domain', domain: 'foo.com' } }
+		//   { 'proxy-viewers': { role: 'viewer', scope: 'global' } }
+		groupRoleMap: {},
+		// Local users always treated as global admin (anti-lockout bootstrap).
+		adminUsers: ['proxyadmin2'],
+	},
+
 	service:{
 		hostScheduler:{
 			enabled: true,