Fix OIDC users unable to access UI after login

[drifterza]

Fixes #458

When new OIDC users log in after the first user, they get the member role with no capabilities. Previously this showed an unhelpful access denied message.

This adds a dedicated pending approval page that:

• Shows the user their account needs admin approval
• Lists next steps (admin review, approval notification)
• Provides the tailscale command to connect devices while waiting
• Auto-refreshes every 3 seconds to detect when approval is granted
• Redirects to /machines once the user has access

Also shows "Pending Approval" status in the users list so admins can see who needs approval.

Includes unit tests for the roles system and live data refresh behavior.

Update: Changed from manual refresh button to automatic polling using the existing useLiveData() hook per reviewer feedback.

[tale]

We have a useLiveData() hook (or something similarly named). This would be a good way to automatically check for access and refresh (something which I think should've already been there from the start).

Please switch your implementation to check every 3 seconds instead of explicitly checking to align with the rest of Headplane's UI.

[drifterza]

We have a useLiveData() hook (or something similarly named). This would be a good way to automatically check for access and refresh (something which I think should've already been there from the start).

Please switch your implementation to check every 3 seconds instead of explicitly checking to align with the rest of Headplane's UI.

@tale : Like this? See description.

[tale]

Amazing, and I love the unit tests, thank you so much!