Enforce SSO assurance and production acceptance for v0.1.2

[tiammomo]

Deployments can now require SSO and an exact signed OIDC authentication class. The backend rejects password fallback under that policy and refuses SSO-only startup unless an active administrator is already linked to the issuer. Password login stays enabled by default for existing deployments.

The PostgreSQL CI gate now runs isolated signed OIDC/PKCE, Messages and Chat Completions text/stream/tool turns, 40 distinct users, cancellation, process/database faults, backup restoration and rollback with the attested v0.1.1 binary. One existing entry, scripts/acceptance.sh --isolated, runs these checks without deployment credentials or paid calls. Evidence distinguishes successful requests from admission rejection and synthetic results from production capacity.

Release tags must point to protected main. All release assets are uploaded to a draft before immutable publication. Document the applied branch/tag/security controls, the current zero independent approvals, and remaining deployment-specific acceptance; correct stale DNS and migration guidance. Prepare v0.1.2, including previously merged internal simplification changes.

Validation:

• Complete repository gate: 476 Rust, 128 frontend and 15 script tests; formatting, Clippy, lint, builds and documentation checks.
• 21 isolated runtime tests, including actual previous-release rollback, passed on v0.1.2; an additional 60-second paced synthetic run completed.
• Live PostgreSQL migration/state/transaction/concurrent-admission tests passed.
• Actionlint with ShellCheck, both Compose manifests and dashboard dependency audit passed.
• All 21 browser regressions passed against the isolated PostgreSQL gateway; required CI must pass before merge.

Actual IdP MFA, real Provider/GPU capacity, production restore timing and host rollout remain deployment-specific gates. The release remains a single-instance Small-Team Beta.