painfree 0.2.1

Two fixes found by pointing a deployment at a real bank, and the second is the
one that cost an afternoon.

The header nobody chose

urllib supplies User-Agent: Python-urllib/3.x unless told otherwise, and at
least one Swiss bank's web application firewall blocks that string: HTTP 400 and
an HTML error page, before the EBICS connector sees the request. The same
endpoint answers a request carrying no User-Agent normally.

painfree now sends none. PAINFREE_EBICS_USER_AGENT sets one for a bank that
asks for a particular string; empty and unset both mean no header.

A body that is not a document is refused where it arrives

That HTML page was then handed to the XML parser, so the error an operator saw
was Opening and ending tag mismatch: link line 9 and head — a malformed
document, when the cause was an HTTP header and the document was never the
bank's. Nothing in that message could lead anybody to a firewall.

A response that does not open as XML now fails in the transport, naming the
status, the content type, and quoting the first 200 bytes, so the middlebox's
own words are in the error. A well-formed EBICS error with a 500 still comes
through untouched, because the return code inside it is the point.

Also

• Local accounts get out of the way where an identity provider is configured:
  the console entry is hidden and creating one is refused, because a password is
  only accepted in basic mode. Accounts that already exist stay listed and
  removable.
• Every PAINFREE_OIDC_* setting now reaches the container. AUDIENCE and
  SCOPE_CLAIM were declared, used, and passed to nothing, so a deployment
  serving machines from a second client could not name an audience.
• deploy/production.env.example had the wrong callback: it is
  /auth/callback, not /ui/auth/callback.

Upgrading

Nothing to do beyond pulling 0.2.1. If you are still on 0.1.0, read the
0.2.0 notes first: the state moved from named volumes to bind mounts, and that
migration is not automatic.