Add OIDC login and per-domain authorization

Authentication previously implied full authorization: any valid token
could manage every host, DNS provider, domain, and user. This adds SSO
login and a per-domain rights model.

OIDC login (authorization_code + PKCE):
- conf.oidc + conf.auth blocks; clientSecret in (gitignored) secrets.js.
- utils/oidc.js (state/PKCE, code exchange, userinfo) using global fetch.
- models/oidc_state.js: short-lived state store, auto-expiring via
  model-redis 1.5 per-key TTL.
- routes/auth.js: GET /auth/oidc/start + /auth/oidc/callback; JIT-provisions
  a local user, mints an AuthToken carrying the SSO groups, hands the token to
  the browser via a URL fragment. "Log in with SSO" button on the login page.

Authorization (groups + app overrides, per-domain, with ownership):
- models/grant.js + utils/roles.js (pure, unit-tested): effective rights from
  conf.auth (admin users/groups, group->role map), Grant records
  (user|group -> global|domain -> viewer|manager|admin), and ownership
  (created_by). Roles rank admin > manager(owner) > viewer.
- AuthToken stores session groups; middleware/auth.js exposes req.groups.
- middleware/authz.js: requireAdmin, requireDomainRole(minRole, resolveDomain),
  filterViewable. Applied across routes: host mutations need manager on the
  host's domain; reads are filtered to visible domains; DNS providers, user
  management, and grant management are global-admin-only; certs need viewer.
- routes/grant.js: admin CRUD for grants. Anti-lockout via conf.auth.adminUsers
  plus migrations/grant_bootstrap.js.

Frontend: /me returns effective rights; nav gates Users/Grants to admins;
grants management page; OIDC token-fragment handling in app-base.js.

Tests: utils/roles and utils/oidc unit-tested (no redis); wired into the test
scripts. Full suite 89 pass. Also verified end-to-end against redis (grant
resolution, middleware allow/deny/403, list filtering) and the OIDC pure flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/models/auth.js

@@ -47,7 +47,10 @@ class Auth{
 	static async login(data){
 		try{
 			let user = await User.login(data);
-			let token = await AuthToken.create({username: user.username});
+			// Backends may attach group membership to the user (LDAP); default
+			// to none for local/redis users.
+			let groups = Array.isArray(user.groups) ? user.groups : [];
+			let token = await AuthToken.create({username: user.username, groups});
 
 			return {user, token}
 		}catch(error){
@@ -56,6 +59,25 @@ class Auth{
 		}
 	}
 
+	/**
+	 * Establish a session for an OIDC-authenticated identity: JIT-provision the
+	 * local user (redis-backed) and mint an AuthToken carrying the SSO groups.
+	 *
+	 * @param {Object} identity - {username, groups} from utils/oidc claims
+	 * @returns {Object} {user, token}
+	 */
+	static async oidcSession(identity){
+		let user = typeof User.upsertOidc === 'function'
+			? await User.upsertOidc(identity)
+			: await User.get(identity.username);
+		let token = await AuthToken.create({
+			username: user.username,
+			groups: identity.groups || [],
+		});
+
+		return {user, token};
+	}
+
 	/**
 	 * Validate an authentication token.
 	 *