feat(auth): allow sign-in by verified email domain, not just login allowlist

[danielnaab]

Previously the only path to authorization was a comma-separated GitHub login allowlist in `ALLOWED_USERS`, defaulting to `danielnaab`. A Flexion colleague whose GitHub login wasn't on that list got redirected with `error=unauthorized` — fine for a solo dev project but the wrong default for a team resource.

Change

A user now passes authorization if their GitHub login is in `ALLOWED_USERS` or any of their verified GitHub emails matches a domain in `ALLOWED_EMAIL_DOMAINS`. Either mechanism alone is sufficient; evaluated in that order so a personal-dev login still works on an instance with a strict corporate-domain policy.

Details:

• New `fetchUserEmails(token)` → `/user/emails`. Requires `user:email` OAuth scope, which is now requested at sign-in alongside the existing `read:user read:org`.
• Empty-list fallback on 404 (scope missing) rather than throw — the login allowlist still covers the user.
• New `hasAllowedEmailDomain(emails, domains)` — case-insensitive exact domain match, verified emails only. Explicitly rejects substring matches (`not-flexion.us` is not admitted when the allowed domain is `flexion.us`).
• Auth callback logs which path authorised the user so operators can audit who's getting in via domain vs. login.

Defaults

• `ALLOWED_USERS=danielnaab` (unchanged).
• `ALLOWED_EMAIL_DOMAINS` unset by default — no change in default behaviour on instances that don't set it.

Production rollout

`infrastructure/nixos/modules/deploy.nix` now sets `ALLOWED_EMAIL_DOMAINS=flexion.us` in the per-branch env file. Takes effect after `bun run cli nixos apply` on the EC2 instance and a branch redeploy. Existing users aren't affected — the login allowlist is still checked first.

Testing

• `bun run check` — 1341 tests pass.
• New unit tests for `fetchUserEmails` (happy path, scope-missing 404 fallback) and `hasAllowedEmailDomain` (verified/unverified, case, multi-domain, substring rejection, empty-list rejection).
• Existing `auth-routes` scope assertion updated to the new scope string (`read:user read:org user:email`).

Security notes

• Only `verified: true` emails count. A user can't claim an arbitrary domain they don't control because GitHub verifies by sending a confirmation email to that address.
• The matcher does exact domain equality, not suffix matching. `evil.flexion.us` or `not-flexion.us` are rejected.
• The existing session-cookie encryption and HttpOnly/SameSite=Lax flags are unchanged.