Add OIDC login and per-domain authorization

Authentication previously implied full authorization: any valid token
could manage every host, DNS provider, domain, and user. This adds SSO
login and a per-domain rights model.

OIDC login (authorization_code + PKCE):
- conf.oidc + conf.auth blocks; clientSecret in (gitignored) secrets.js.
- utils/oidc.js (state/PKCE, code exchange, userinfo) using global fetch.
- models/oidc_state.js: short-lived state store, auto-expiring via
  model-redis 1.5 per-key TTL.
- routes/auth.js: GET /auth/oidc/start + /auth/oidc/callback; JIT-provisions
  a local user, mints an AuthToken carrying the SSO groups, hands the token to
  the browser via a URL fragment. "Log in with SSO" button on the login page.

Authorization (groups + app overrides, per-domain, with ownership):
- models/grant.js + utils/roles.js (pure, unit-tested): effective rights from
  conf.auth (admin users/groups, group->role map), Grant records
  (user|group -> global|domain -> viewer|manager|admin), and ownership
  (created_by). Roles rank admin > manager(owner) > viewer.
- AuthToken stores session groups; middleware/auth.js exposes req.groups.
- middleware/authz.js: requireAdmin, requireDomainRole(minRole, resolveDomain),
  filterViewable. Applied across routes: host mutations need manager on the
  host's domain; reads are filtered to visible domains; DNS providers, user
  management, and grant management are global-admin-only; certs need viewer.
- routes/grant.js: admin CRUD for grants. Anti-lockout via conf.auth.adminUsers
  plus migrations/grant_bootstrap.js.

Frontend: /me returns effective rights; nav gates Users/Grants to admins;
grants management page; OIDC token-fragment handling in app-base.js.

Tests: utils/roles and utils/oidc unit-tested (no redis); wired into the test
scripts. Full suite 89 pass. Also verified end-to-end against redis (grant
resolution, middleware allow/deny/403, list filtering) and the OIDC pure flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/routes/host.js

@@ -2,22 +2,28 @@
 
 const router = require('express').Router();
 const {Host, Domain} = require('../models').models;
+const authz = require('../middleware/authz');
 
 const Model = Host;
 
 router.get('/', async function(req, res, next){
 	try{
-		return res.json({
-			results: await Model[req.query.detail ? "listDetail" : "list"](),
-		});
+		let results = await Model[req.query.detail ? "listDetail" : "list"]();
+
+		// Restrict to hosts whose domain the caller may view. list() yields host
+		// strings; listDetail() yields instances with a .host.
+		results = await authz.filterViewable(req, results,
+			item => (typeof item === 'string' ? item : item.host));
+
+		return res.json({results});
 	}catch(error){
 		return next(error);
 	}
 });
 
-router.post('/', async function(req, res, next){
+router.post('/', authz.requireDomainRole('manager', authz.resolve.hostBody), async function(req, res, next){
 	try{
-		req.body.created_by = req.user.username;
+		req.body.created_by = authz.reqUsername(req);
 		let item = await Model.create(req.body);
 
 		return res.json({
@@ -29,7 +35,7 @@ router.post('/', async function(req, res, next){
 	}
 });
 
-router.get('/lookup/:item', async function(req, res, next){
+router.get('/lookup/:item', authz.requireDomainRole('viewer', authz.resolve.hostParam), async function(req, res, next){
 	try{
 		return res.json({
 			string: req.params.item,
@@ -41,7 +47,8 @@ router.get('/lookup/:item', async function(req, res, next){
 	}
 });
 
-router.get('/lookupobj', async function(req, res, next){
+// The full lookup tree exposes every host, so restrict it to admins.
+router.get('/lookupobj', authz.requireAdmin, async function(req, res, next){
 	try{
 		return res.json({
 			results: Model.lookUpObj,
@@ -52,7 +59,7 @@ router.get('/lookupobj', async function(req, res, next){
 	}
 });
 
-router.delete('/cache', async function(req, res, next){
+router.delete('/cache', authz.requireAdmin, async function(req, res, next){
 	try{
 		let count = await Model.clearCache();
 
@@ -65,7 +72,7 @@ router.delete('/cache', async function(req, res, next){
 	}
 });
 
-router.get('/:item', async function(req, res, next){
+router.get('/:item', authz.requireDomainRole('viewer', authz.resolve.hostParam), async function(req, res, next){
 	try{
 
 		return res.json({
@@ -77,9 +84,9 @@ router.get('/:item', async function(req, res, next){
 	}
 });
 
-router.put('/:item', async function(req, res, next){
+router.put('/:item', authz.requireDomainRole('manager', authz.resolve.hostParam), async function(req, res, next){
 	try{
-		req.body.updated_by = req.user.username;
+		req.body.updated_by = authz.reqUsername(req);
 		let item = await Model.get(req.params.item);
 		item = await item.update(req.body);
 
@@ -95,7 +102,7 @@ router.put('/:item', async function(req, res, next){
 	}
 });
 
-router.delete('/:item', async function(req, res, next){
+router.delete('/:item', authz.requireDomainRole('manager', authz.resolve.hostParam), async function(req, res, next){
 	try{
 		let item = await Model.get(req.params.item);
 		let count = await item.remove();
@@ -110,7 +117,7 @@ router.delete('/:item', async function(req, res, next){
 	}
 });
 
-router.put('/:item/renew', async function(req, res, next){
+router.put('/:item/renew', authz.requireDomainRole('manager', authz.resolve.hostParam), async function(req, res, next){
 	try{
 		let item = await Model.get(req.params.item);
 		item.createWildcardCert();