v8.7.6 — OIDC: group→role mapping + Entra ID how-to (closes #11)

Closes #11 raised by @patrickklaeren. The OIDC backbone (discovery + RS256 JWKS verification + state CSRF + callback + SSO login button) has been in place since v8.0 and already works with Microsoft Entra ID out of the box. This release closes the two real gaps:

Group → role mapping (new)

Four new env vars:

• OIDC_GROUP_CLAIM (default groups)
• OIDC_ROLE_ADMIN_GROUPS / OIDC_ROLE_OPERATOR_GROUPS / OIDC_ROLE_VIEWER_GROUPS (comma-separated; Entra GUIDs or display names)

Precedence: admin > operator > viewer when a user is in groups for multiple roles. Case-insensitive exact match.

Re-evaluated on every login when any list is configured — removing someone from the Entra admin group demotes them in Docker Dash on their next sign-in (audit-logged as SSO user role updated from IdP).

Non-breaking: when no group lists are configured, behaviour is exactly as before — every SSO user gets OIDC_DEFAULT_ROLE and existing user roles are never overwritten by OIDC.

Documentation (new)

New how-to under Security: OIDC SSO with Microsoft Entra ID (Azure AD) — full setup from app registration through groups-claim emission, env-var template, role-assignment semantics, and troubleshooting. Notes the same contract works for Okta / Keycloak / Google Workspace / Authentik / Authelia.

Tests

12 new unit cases for the pure _resolveRoleFromGroups resolver (precedence, GUID + display-name matching, custom claim name, defensive nulls).