Release v4.211.0

Rendered applications now sign people in through AuthProxy and onboard them through their own Ante: a model's authentication and onboarding blocks become running code instead of warnings.

Added

• Applications rendered from a model with authentication trust the identity AuthProxy forwards, so authenticated, role and claim policies hold for signed-in callers, and personas map to the roles and claims their policies require (#915)
• The provider list AuthProxy needs and the environment keys the application reads are rendered as .runtime/authproxy.application.json and .runtime/environment.json
• Applications rendered from a model with onboarding subscribe to their Ante's outcomes and provision once per outcome: a new tenant becomes a Chronicle namespace, its first member gets the as persona, and joins grant only the personas the model allows (#916)
• An InviteMemberToTenant command restricted to the model's inviting personas and grantable personas
• Invitation and welcome emails sent through Herald from the model's templates and images, once per invitation or registration
• An invitation Ante rejects is recorded as OnboardingInvitationRejected with a warning for an administrator; the invitee is not emailed. The signupDeclined template is rendered but not sent until Ante publishes a declined sign-up, which the render reports as STAGE-ONBOARDING-007 (see Cratis/Ante#207)
• The Ante:Onboarding configuration for the application's Ante is rendered as .runtime/ante.onboarding.json
• The sandbox option Stage:Sandbox:ForwardedIdentity trusts the identity AuthProxy forwards instead of playing a persona, and the sandbox reads the Chronicle connection string from CRATIS_CHRONICLE_CONNECTION_STRING_FILE
• Documentation: Onboarding rendering

Changed

• Rendered applications with onboarding use Chronicle 19.114.0, which Cratis.Ante.Contracts requires; other applications keep their Chronicle version
• Stage renders with Screenplay 4.259.0