Tribu 1.7.0

What's changed

• Single Sign-On via OpenID Connect (#167, #193). Tribu now delegates
  authentication to any OIDC-compatible identity provider with PKCE-
  protected authorization-code flow and JWKS-verified ID tokens.
  Provider presets ship for Authentik, Zitadel, and Keycloak plus a
  generic fallback. A new Admin > Single Sign-On panel covers issuer,
  client credentials, scopes, button label, and an inline test of the
  provider's discovery document. Invitation links can finish onboarding
  entirely through the IdP. Password login can be disabled once SSO has
  proven itself end-to-end, with a 30-day proof-of-life window so a
  broken SSO config cannot lock admins out.
• MIT license (#175). Tribu is now released under the MIT license.
  See the LICENSE file and the README badge.
• README and community overhaul (#174, #176-#190, #194). Clearer
  positioning for families and self-hosters, stronger trust signals,
  framed mobile and desktop hero screenshots, a repo-local
  CONTRIBUTING.md, a PR template, and polished community entry points.

Upgrade Notes

• Migration 0030 adds the oidc_identities table and makes
  users.password_hash nullable so SSO-only accounts can exist. The
  backend container runs alembic upgrade head on startup before
  uvicorn.
• If you enable SSO, register <your-tribu>/auth/oidc/callback as the
  redirect URI at your provider. The admin panel shows the exact URL
  Tribu will submit so it matches what you register.
• Tribu's frontend already rewrites /auth/oidc/* to the backend. If
  your reverse proxy routes /api/* directly, keep /auth/oidc/*
  going through the frontend so the callback URL stays consistent.
• The OIDC client secret is stored in system_settings as plaintext,
  same trust model as JWT_SECRET. Put the database volume on
  encrypted storage if your threat model requires it.

Verification

• Backend 295 tests green, +27 over v1.6.1 covering OIDC configuration,
  discovery hardening, token exchange with basic-auth fallback, real
  RS256 ID token verification, lockout-gate edge cases, and redirect_uri
  pinning across proxy-host drift.
• Frontend 143 tests green, +13 covering the SSO login button, admin
  settings panel, effective callback URL alignment, and invite-bound
  SSO signup.
• Next.js production build clean.
• End-to-end Docker-compose smoke against a real IdP discovery endpoint.