Add OIDC login and per-domain authorization

Authentication previously implied full authorization: any valid token
could manage every host, DNS provider, domain, and user. This adds SSO
login and a per-domain rights model.

OIDC login (authorization_code + PKCE):
- conf.oidc + conf.auth blocks; clientSecret in (gitignored) secrets.js.
- utils/oidc.js (state/PKCE, code exchange, userinfo) using global fetch.
- models/oidc_state.js: short-lived state store, auto-expiring via
  model-redis 1.5 per-key TTL.
- routes/auth.js: GET /auth/oidc/start + /auth/oidc/callback; JIT-provisions
  a local user, mints an AuthToken carrying the SSO groups, hands the token to
  the browser via a URL fragment. "Log in with SSO" button on the login page.

Authorization (groups + app overrides, per-domain, with ownership):
- models/grant.js + utils/roles.js (pure, unit-tested): effective rights from
  conf.auth (admin users/groups, group->role map), Grant records
  (user|group -> global|domain -> viewer|manager|admin), and ownership
  (created_by). Roles rank admin > manager(owner) > viewer.
- AuthToken stores session groups; middleware/auth.js exposes req.groups.
- middleware/authz.js: requireAdmin, requireDomainRole(minRole, resolveDomain),
  filterViewable. Applied across routes: host mutations need manager on the
  host's domain; reads are filtered to visible domains; DNS providers, user
  management, and grant management are global-admin-only; certs need viewer.
- routes/grant.js: admin CRUD for grants. Anti-lockout via conf.auth.adminUsers
  plus migrations/grant_bootstrap.js.

Frontend: /me returns effective rights; nav gates Users/Grants to admins;
grants management page; OIDC token-fragment handling in app-base.js.

Tests: utils/roles and utils/oidc unit-tested (no redis); wired into the test
scripts. Full suite 89 pass. Also verified end-to-end against redis (grant
resolution, middleware allow/deny/403, list filtering) and the OIDC pure flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/public/lib/js/app-base.js

@@ -191,7 +191,8 @@ app.auth = (function(app){
 	function isLoggedIn(callback){
 		if(getToken()){
 			return app.api.get('user/me', function(error, data){
-				if(!error) app.auth.user = data;
+				// data now carries effective rights (isAdmin, global, domains).
+				if(!error) app.auth.user = app.auth.perms = data;
 				return callback(error, data);
 			});
 		}else{
@@ -199,6 +200,28 @@ app.auth = (function(app){
 		}
 	}
 
+	// Consume an app token handed back by the OIDC callback via the URL
+	// fragment (#token=…&redirect=…). Stores it, strips the fragment, and
+	// forwards to the intended page. Returns true if a token was consumed.
+	function consumeTokenFragment(){
+		if(!location.hash) return false;
+		var params = new URLSearchParams(location.hash.replace(/^#/, ''));
+		var token = params.get('token');
+		if(!token) return false;
+
+		setToken(token);
+		var redirect = params.get('redirect') || '/';
+		// Drop the token from the address bar before navigating on.
+		history.replaceState(null, '', location.pathname + location.search);
+		window.location.href = redirect;
+		return true;
+	}
+
+	// True when the logged-in user is a global admin (per user/me).
+	function isAdmin(){
+		return !!(app.auth.perms && app.auth.perms.isAdmin);
+	}
+
 	function logIn(args, callback){
 		app.api.post('auth/login', args, function(error, data){
 			if(data.login){
@@ -233,6 +256,9 @@ app.auth = (function(app){
 		getToken: getToken,
 		setToken: setToken,
 		isLoggedIn: isLoggedIn,
+		consumeTokenFragment: consumeTokenFragment,
+		isAdmin: isAdmin,
+		perms: null,
 		logIn: logIn,
 		logOut: logOut,
 		forceLogin,
@@ -270,6 +296,29 @@ app.user = (function(app){
 
 })(app);
 
+app.grant = (function(app){
+	function list(callback){
+		app.api.get('grant/', function(error, data){
+			callback(error, data);
+		});
+	}
+
+	function add(args, callback){
+		app.api.post('grant/', args, function(error, data){
+			callback(error, data);
+		});
+	}
+
+	function remove(id, callback){
+		app.api.delete('grant/' + encodeURIComponent(id), function(error, data){
+			callback(error, data);
+		});
+	}
+
+	return {list, add, remove};
+
+})(app);
+
 app.util = (function(app){
 
 	function getUrlParameter(name){