Let each team name its own OIDC group, not a global mapping

Team membership from single sign-on used to come from one env var,
TERDUT_OIDC_GROUP_MAPPINGS, matched against a team by name and creating
the team if none existed. That put the decision in the server's
environment rather than the team's own hands, needed a restart to
change, and let a typo in a team name silently create a stray team.

Each team now carries its own oidc_member_group and oidc_owner_group,
set by its owner (or an administrator) from the Members tab, or PUT
/api/teams/{teamID}/oidc-groups. The "highest role wins" rule
TERDUT_OIDC_GROUP_MAPPINGS used to apply across mappings now applies
across one team's own two fields: being in both makes somebody an
owner. The sync no longer creates a team by name; a group only ever
grants into a team that already exists.

This is a breaking change for anyone already using
TERDUT_OIDC_GROUP_MAPPINGS, deliberately not auto-migrated: an
OIDC-sourced membership is dropped at a user's next sign-in until its
team's owner re-sets the group. The README's OIDC section spells out
the migration and the risk of a visible access gap during it.

TERDUT_OIDC_ADMIN_GROUP and TERDUT_OIDC_ALLOWED_GROUPS are untouched --
only team membership moved. terdut-tui needs no change: it only reads
GET /api/teams and GET /api/teams/{id}/members, and neither response
shape moved.

charts/terdut-server/templates/deployment.yaml

@@ -107,10 +107,6 @@ spec:
             - name: TERDUT_OIDC_ADMIN_GROUP
               value: {{ .Values.oidc.adminGroup | quote }}
             {{- end }}
-            {{- if .Values.oidc.groupMappings }}
-            - name: TERDUT_OIDC_GROUP_MAPPINGS
-              value: {{ .Values.oidc.groupMappings | toJson | quote }}
-            {{- end }}
             {{- end }}
           livenessProbe:
             httpGet:

charts/terdut-server/values.yaml

@@ -148,12 +148,10 @@ oidc:
   allowedGroups: []
   # Members of this group are system administrators.
   adminGroup: ""
-  # Team roles from groups. A team that does not exist is created. Where several
-  # groups grant the same team the highest role wins.
-  #   - group: sre
-  #     team: SRE
-  #     role: member      # member or owner
-  groupMappings: []
+  # Which group grants a team's membership and ownership is each team's own
+  # setting now, not chart config: an owner sets it from the Members tab, or
+  # PUT /api/teams/{teamID}/oidc-groups. A team must already exist for a group
+  # to grant access to it.
   # Hard ceiling on a session made by a single sign-on login.
   sessionMaxAge: 12h