feat: Authentik OIDC SSO, allow/deny RBAC, admin console & Gitea CI

Authentication & RBAC
- Add confidential OIDC client (Authentik) with /auth/oidc/login +
  /auth/oidc/callback: discovery, code exchange, id_token verify (go-oidc),
  groups claim → role (Archivum-admin → admin, else user). Sessions carry groups.
- Rework ACL into an allow/deny model (new `effect` column + migration).
  db.EffectiveAccess resolves user + all groups over the path and its ancestors:
  default deny, explicit deny always beats allow.
- Enforce ACL for ALL non-admin users (not just guest) across list/read/save/
  delete/move/create/history/diff/images/upload. Admins bypass.
- Seed built-in Archivum-admin / Archivum-reader groups; login allow-list on
  users & groups; public (guest) user access is ACL-configurable.

Admin API & UI
- New GraphQL ops: oidcConfig/updateOidcConfig, group CRUD, membership,
  setUserRole/setUserLogin/setGroupLogin, userGroups, loginOptions.
- Rebuilt AdminView: SSO config, user/group management + membership, login
  toggles, and an allow/deny access-control matrix per path.
- LoginView: "Sign in with Authentik" + public-user option; OIDC callback route.

Rendering/editor
- Fix bug where inline marks (bold/italic/code/strike/link) were dropped on
  TipTap→AsciiDoc save. Add RENDERING_IMPROVEMENTS.md with proposals.

CI / build
- .gitea/workflows/build.yaml: build on the Pi5 runner, push
  localhost:5000/archivum:{latest,<sha>}. Add .dockerignore; bump Go image to 1.25.
- Docs: ARCHITECTURE.md, README.md, docs/AUTHENTIK_SETUP.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/internal/graph/schema.graphql

@@ -49,6 +49,18 @@ type Query {
 
   # Returns the role of the currently authenticated user ("admin", "user", "guest").
   currentUserRole: String!
+
+  # Sign-in methods the login page should offer (public, no auth required).
+  loginOptions: LoginOptions!
+
+  # All local/external users with role & login state (admin only).
+  users: [UserInfo!]!
+
+  # Current OpenID Connect (Authentik) configuration (admin only, no secret).
+  oidcConfig: OIDCConfigView!
+
+  # Names of the groups a user belongs to (admin only).
+  userGroups(username: String!): [String!]!
 }
 
 type Mutation {
@@ -73,9 +85,25 @@ type Mutation {
   # Modify LDAP Configuration (admin only).
   updateLdapConfig(input: LDAPInput): Boolean!
 
+  # Modify OpenID Connect (Authentik) configuration (admin only).
+  updateOidcConfig(input: OIDCInput!): Boolean!
+
   # Sync users/groups from LDAP
   importLdapSubject(type: String!, name: String!): Boolean!
 
+  # Group management (admin only).
+  createGroup(name: String!): Boolean!
+  deleteGroup(name: String!): Boolean!
+  addUserToGroup(username: String!, group: String!): Boolean!
+  removeUserFromGroup(username: String!, group: String!): Boolean!
+
+  # Who may sign in (admin only).
+  setUserLogin(username: String!, allow: Boolean!): Boolean!
+  setGroupLogin(name: String!, allow: Boolean!): Boolean!
+
+  # Change a user's application role: "admin" | "user" (admin only).
+  setUserRole(username: String!, role: String!): Boolean!
+
   # ACL Mutations
   setAcl(input: ACLInput!): Boolean!
   removeAcl(id: Int!): Boolean!
@@ -127,6 +155,7 @@ type ACLEntry {
   path:       String!
   subjectType: String!
   subjectId:  Int!
+  effect:     String!   # "allow" | "deny" — deny always wins over allow
   canSearch:  Boolean!
   canView:    Boolean!
   canRead:    Boolean!
@@ -136,6 +165,35 @@ type ACLEntry {
   canMove:    Boolean!
 }
 
+type LoginOptions {
+  localEnabled:    Boolean!
+  oidcEnabled:     Boolean!
+  oidcButtonLabel: String!
+  publicEnabled:   Boolean!
+}
+
+type UserInfo {
+  username:   String!
+  role:       String!
+  isLdap:     Boolean!
+  allowLogin: Boolean!
+  createdAt:  String!
+}
+
+type OIDCConfigView {
+  enabled:         Boolean!
+  ready:           Boolean!
+  issuer:          String!
+  clientId:        String!
+  clientSecretSet: Boolean!
+  redirectUrl:     String!
+  publicUrl:       String!
+  groupsClaim:     String!
+  usernameClaim:   String!
+  adminGroup:      String!
+  readerGroup:     String!
+}
+
 type ServerDirectory {
   name:      String!
   path:      String!
@@ -198,9 +256,11 @@ input LDAPInput {
 }
 
 type ACLSubject {
-  id:     Int!
-  name:   String!
-  isLdap: Boolean!
+  id:         Int!
+  name:       String!
+  isLdap:     Boolean!
+  role:       String    # only present for users
+  allowLogin: Boolean!
 }
 
 type ACLSubjects {
@@ -212,6 +272,7 @@ input ACLInput {
   path:       String!
   subjectType: String!
   subjectId:  Int!
+  effect:     String    # "allow" (default) | "deny"
   canSearch:  Boolean!
   canView:    Boolean!
   canRead:    Boolean!
@@ -221,6 +282,19 @@ input ACLInput {
   canMove:    Boolean!
 }
 
+input OIDCInput {
+  enabled:       Boolean!
+  issuer:        String!
+  clientId:      String!
+  clientSecret:  String   # empty = keep existing
+  redirectUrl:   String
+  publicUrl:     String
+  groupsClaim:   String
+  usernameClaim: String
+  adminGroup:    String
+  readerGroup:   String
+}
+
 input SaveDocumentInput {
   slug:          String!
   content:       String!