feat: OIDC group-to-role mapping and various improvements

[pezzking]

Summary

• OIDC Group-to-Role Mapping: Automatically assign Console roles based on OIDC group membership
• Global Admin Groups: Configure OIDC groups that grant global admin access via OIDC_ADMIN_GROUPS env var
• Configurable PULSAR_CLUSTER: Make cluster name configurable via environment variable
• New OIDC Groups Settings Page: UI for configuring group mappings per environment

Features

OIDC Group Mapping

• Extract groups from OIDC token using configurable claim name (OIDC_ROLE_CLAIM, default: groups)
• Map OIDC groups to Console roles (e.g., developers → developer, platform-team → admin)
• Global admin groups grant is_global_admin=True to users
• Optional role sync on every login (OIDC_SYNC_ROLES_ON_LOGIN)
• Configure via environment variables OR per-environment database settings via UI

New Environment Variables

Variable	Description	Default
OIDC_ROLE_CLAIM	OIDC claim containing user groups	groups
OIDC_ADMIN_GROUPS	Comma-separated admin groups	—
OIDC_SYNC_ROLES_ON_LOGIN	Sync roles on every login	true
PULSAR_CLUSTER	Pulsar cluster name	standalone

Changes

Backend

• Add group mapping fields to oidc_providers table (migration 007)
• Update auth service with group extraction and role mapping logic
• Add OIDC provider CRUD endpoints (GET/POST/PUT/DELETE /{env_id}/oidc-provider)
• Support virtual OIDC provider config when using global env vars

Frontend

• New OIDCSettingsPage for configuring group mappings
• Add "OIDC Groups" navigation item in Settings sidebar
• Update API hooks and types for OIDC provider config

Documentation

• Update README with OIDC group mapping documentation
• Add .env.example with all configuration options

Test plan

• Configure OIDC_ADMIN_GROUPS=admins and verify users in that group become global admins
• Create group-to-role mapping in UI and verify role assignment on login
• Test with OIDC_SYNC_ROLES_ON_LOGIN=true to verify role removal when user leaves group
• Verify UI works with both global OIDC config and per-environment database config

🤖 Generated with Claude Code