Add OIDC login and per-domain authorization

Authentication previously implied full authorization: any valid token
could manage every host, DNS provider, domain, and user. This adds SSO
login and a per-domain rights model.

OIDC login (authorization_code + PKCE):
- conf.oidc + conf.auth blocks; clientSecret in (gitignored) secrets.js.
- utils/oidc.js (state/PKCE, code exchange, userinfo) using global fetch.
- models/oidc_state.js: short-lived state store, auto-expiring via
  model-redis 1.5 per-key TTL.
- routes/auth.js: GET /auth/oidc/start + /auth/oidc/callback; JIT-provisions
  a local user, mints an AuthToken carrying the SSO groups, hands the token to
  the browser via a URL fragment. "Log in with SSO" button on the login page.

Authorization (groups + app overrides, per-domain, with ownership):
- models/grant.js + utils/roles.js (pure, unit-tested): effective rights from
  conf.auth (admin users/groups, group->role map), Grant records
  (user|group -> global|domain -> viewer|manager|admin), and ownership
  (created_by). Roles rank admin > manager(owner) > viewer.
- AuthToken stores session groups; middleware/auth.js exposes req.groups.
- middleware/authz.js: requireAdmin, requireDomainRole(minRole, resolveDomain),
  filterViewable. Applied across routes: host mutations need manager on the
  host's domain; reads are filtered to visible domains; DNS providers, user
  management, and grant management are global-admin-only; certs need viewer.
- routes/grant.js: admin CRUD for grants. Anti-lockout via conf.auth.adminUsers
  plus migrations/grant_bootstrap.js.

Frontend: /me returns effective rights; nav gates Users/Grants to admins;
grants management page; OIDC token-fragment handling in app-base.js.

Tests: utils/roles and utils/oidc unit-tested (no redis); wired into the test
scripts. Full suite 89 pass. Also verified end-to-end against redis (grant
resolution, middleware allow/deny/403, list filtering) and the OIDC pure flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/routes/user.js

@@ -1,9 +1,14 @@
 'use strict';
 
 const router = require('express').Router();
-const {User} = require('../models').models; 
+const {User} = require('../models').models;
+const authz = require('../middleware/authz');
 
-router.get('/', async function(req, res, next){
+// User management is global-admin-only, except the self-service routes below
+// (GET /me, PUT /password, POST /key) which any authenticated user may call for
+// their own account.
+
+router.get('/', authz.requireAdmin, async function(req, res, next){
 	try{
 		return res.json({
 			results:  await User[req.query.detail ? "listDetail" : "list"]()
@@ -13,9 +18,9 @@ router.get('/', async function(req, res, next){
 	}
 });
 
-router.post('/', async function(req, res, next){
+router.post('/', authz.requireAdmin, async function(req, res, next){
 	try{
-		req.body.created_by = req.user.username
+		req.body.created_by = authz.reqUsername(req)
 
 		return res.json(await User.add(req.body));
 	}catch(error){
@@ -23,7 +28,7 @@ router.post('/', async function(req, res, next){
 	}
 });
 
-router.delete('/:username', async function(req, res, next){
+router.delete('/:username', authz.requireAdmin, async function(req, res, next){
 	try{
 		let user = await User.get(req.params.username);
 
@@ -33,14 +38,24 @@ router.delete('/:username', async function(req, res, next){
 	}
 });
 
+// Self-service: the caller's own identity and effective rights. Drives the
+// frontend's nav/button gating.
 router.get('/me', async function(req, res, next){
 	try{
-		return res.json({username: req.user.username});
+		let effective = await authz.getEffective(req);
+		return res.json({
+			username: authz.reqUsername(req),
+			groups: req.groups || [],
+			isAdmin: effective.isAdmin,
+			global: effective.global,
+			domains: effective.domains,
+		});
 	}catch(error){
 		next(error);
 	}
 });
 
+// Self-service: change your own password.
 router.put('/password', async function(req, res, next){
 	try{
 		return res.json({results: await req.user.setPassword(req.body)})
@@ -49,7 +64,8 @@ router.put('/password', async function(req, res, next){
 	}
 });
 
-router.put('/password/:username', async function(req, res, next){
+// Admin: reset another user's password.
+router.put('/password/:username', authz.requireAdmin, async function(req, res, next){
 	try{
 		let user = await User.get(req.params.username);
 		return res.json({results: await user.setPassword(req.body)});
@@ -58,7 +74,7 @@ router.put('/password/:username', async function(req, res, next){
 	}
 });
 
-router.post('/invite', async function(req, res, next){
+router.post('/invite', authz.requireAdmin, async function(req, res, next){
 	try{
 		let token = await req.user.invite();
 
@@ -68,10 +84,11 @@ router.post('/invite', async function(req, res, next){
 	}
 });
 
+// Self-service: add an SSH key to your own account.
 router.post('/key', async function(req, res, next){
 	try{
 		let added = await User.addSSHkey({
-			username: req.user.username,
+			username: authz.reqUsername(req),
 			key: req.body.key
 		});