feat(auth): sync direct OIDC role claims

[hmans]

Summary

• add direct OIDC role-claim configuration with explicit allowlists, ["*"], and additive/reconcile modes
• persist provider-scoped RBAC role sources and synchronize them during OIDC login, account creation, and linking
• protect source boundaries across manual grants, disconnects, malformed claims, concurrent mutations, provider configuration, and legacy rolling-deploy revokes
• document the configuration and source-aware RBAC model

Closes #1438.

Verification

• mise codegen-proto
• mise test-cli
• mise test-frontend (189 files, 1,908 tests)
• pnpm --dir apps/frontend run check
• mise test-e2e (631-case Playwright suite completed; runner output detached after launch with no failure artifacts)
• mise x uv@latest -- uvx --with charset-normalizer reuse lint

Documentation

• FDR-001, FDR-023, ADR-051, architecture inventory, glossary, environment reference, and external-login guide