docs: split reference material into docs/, keeping the README a shop window (v0.23.4-beta)

Documentation only — no functional change.

The README was carrying two jobs for two different readers. Its Reference section was
the single largest block at 154 lines, and nobody deciding whether to try the project
reads an InfluxDB environment variable table — while the people who need it were
scrolling past the pitch to reach it.

Split along that seam: anything you would read before installing stays in the README,
anything you would read after installing moves to docs/.

  README.md              430 lines   sell, prove, install, feature overview
  docs/change-guard.md   193         safety system, settings, guard states
  docs/architecture.md   116         data stores, polling model, module layout
  docs/capsman.md         84         role model, radio matching, current limits
  docs/alerting.md        81         rules, channels, webhooks, maintenance windows
  docs/api.md             77         scoped tokens, preflight, scripting
  docs/configuration.md   76         environment, secrets, rotation, TLS
  docs/sso-oidc.md        71         identity provider setup and behaviour
  docs/README.md          20         index

In-repo rather than a documentation site, deliberately. A change to Change Guard's
semantics can edit its documentation in the same commit as the code — which, given how
often that behaviour has been refined recently, is the property that actually matters.
A static site generator can point at docs/ later without moving a file.

The Change Guard pitch stays on the front page: the problem framing, the verified
recovery timeline and the quoted prediction warning are what make someone care, and a
reference page is the wrong home for them.

Three sections are new rather than relocated, written because the split exposed the gaps:

  - architecture.md did not exist. It now records why there are three data stores, the
    polling cadences, and which modules are pure functions over a snapshot and why.
  - Scoped API tokens shipped without usage documentation. api.md shows preflighting a
    change from a script and reading the guard block afterwards.
  - change-guard.md records why ip-on-bridge-port is informational rather than critical
    on RouterOS 7 — reasoning that previously existed only in a commit message.

Every internal anchor and cross-file link verified to resolve, including anchors into
other documents. No content dropped, checked by keyword comparison against the previous
single file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/sso-oidc.md

@@ -0,0 +1,71 @@
+# Single sign-on (OIDC)
+
+[← Documentation index](README.md)
+
+Authenticate against any standards-compliant OpenID Connect provider — Microsoft Entra ID,
+Okta, Google Workspace, Keycloak, Authentik and others.
+
+Authorization Code flow with PKCE. The server validates the ID token (JWKS signature plus
+`iss`, `aud`, `exp` and `nonce`) and then issues the platform's normal session, so SSO
+users get the same experience as local ones.
+
+**No environment variables and no redeploy** — everything is configured in the UI, with
+the client secret encrypted at rest.
+
+## 1. Register the application with your provider
+
+Create an OIDC/OAuth **web application** and note:
+
+- **Issuer URL** — the base that serves `/.well-known/openid-configuration`
+- **Client ID**
+- **Client Secret** — optional; public clients with no secret work via PKCE
+
+Set the redirect / callback URI to:
+
+```
+https://<your-host>/api/auth/oidc/callback
+```
+
+The exact value is shown in the settings panel, which is worth copying from rather than
+typing.
+
+## 2. Configure it in the app
+
+As an admin, go to **Settings → SSO / OIDC**.
+
+| Field | Purpose |
+|---|---|
+| **Issuer URL** | Your provider's base URL. **Test discovery** verifies it is reachable before you save. |
+| **Client ID / Secret** | From step 1. The secret is write-only — leave it blank to keep the existing one. |
+| **Scopes** | Default `openid profile email`. Add a groups scope if your IdP needs one to emit group membership. |
+| **Username claim** | Default `preferred_username` |
+| **Email claim** | Default `email` |
+| **Groups claim** | Default `groups` |
+| **Group → role mapping** | Map IdP groups to admin / operator / viewer, e.g. `net-admins → admin`. Highest-privilege match wins. |
+| **Default role** | For users matching no mapping. Defaults to **viewer**. |
+| **Auto-provision** | Create a local user automatically on first sign-in. |
+| **Link by verified email** | Attach an SSO identity to an existing local account when the IdP's `email_verified` matches. |
+| **Allowed email domains** | Optional allowlist restricting who may sign in. |
+| **Public base URL** | Pin the redirect URI when your external URL differs from what the backend sees. |
+| **Button label** | Text on the login button, e.g. "Sign in with Okta". |
+
+Enable it and save. A **Sign in with SSO** button appears on the login page.
+
+## Behaviour and safety
+
+**Provisioning and linking.** First sign-in creates a user when auto-provision is on, or
+links to an existing local account when `email_verified` matches — no duplicate account.
+SSO users have no local password and are labelled with an **SSO** badge under
+Users & Roles.
+
+**Roles are resolved server-side** from your group mapping on every login. Existing users
+are never silently demoted when a login carries no matching group, so a temporary IdP
+misconfiguration cannot strip your admins.
+
+**Break-glass.** Local username and password login stays available. The seeded local admin
+can always get in, even if the IdP is misconfigured, expired, or unreachable. Do not delete
+that account.
+
+**Behind a reverse proxy.** The redirect URI is derived from the request host. If your
+external URL differs from what the backend sees — a proxy, a custom domain, a tunnel —
+set **Public base URL** to pin it, or the provider will reject the callback.