653c79f099
Add Host fields sso_enabled / sso_allow_users / sso_allow_groups (empty allow-lists = any authenticated user) and normalize them (parseAllowList). SSO reuses conf.oidc and is OR'd with basic auth. Enforcement (session cookie + Lua + nginx auth location) lands separately. Unit tests included. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>