feat(gui/oidc): expose AllowedEmailDomains on create + edit forms (A-3)

The CRIT-5 closure (2026-05-10) made `OIDCProvider.AllowedEmailDomains`
load-bearing on the OIDC login path: a token whose email domain isn't in
the configured allowlist gets ErrEmailDomainNotAllowed. But the GUI never
exposed the field — `web/src/pages/auth/OIDCProvidersPage.tsx`'s create
form had zero inputs for it, and `OIDCProviderDetailPage.tsx` neither
rendered nor edited the value.

For multi-tenant IdPs (Auth0, Azure AD common endpoint, Google Workspace)
this is the single most important provider knob — the difference between
"anyone in any tenant of this IdP can log in" and "only @acme.com can log
in." Operators driving certctl from the GUI had no way to know the field
exists, let alone set it. Same shape as CRIT-5's pre-closure state: the
control was claimed, persisted, accepted via API, but invisible at the
surface 90% of operators actually use.

Closure across both GUI pages:

  web/src/pages/auth/OIDCProvidersPage.tsx
    - Create modal gains a chip-style multi-input below fetch_userinfo.
    - New exported `validateEmailDomain(s)` mirrors the backend validator
      (CRIT-5 closure rules: no @ / no whitespace / no wildcards /
      lowercase only / must be FQDN). Returns "" on accept, a
      non-empty error string on reject. Server is still the source of
      truth — server-returned 400s render via the existing error UI.
    - Inline "addEmailDomain" handler: trim → lowercase → validate →
      dedupe → push onto form.allowed_email_domains. Enter key in the
      input adds the entry without requiring a click on Add.
    - Each chip carries a × remove button + data-testid plumbing for
      E2E coverage.

  web/src/pages/auth/OIDCProviderDetailPage.tsx
    - Read-only view's <dl> renders a new row "Allowed email domains"
      with an explicit "any (no gate configured)" sentinel when the
      list is empty. Operators can tell the difference between "not
      configured" and "field exists but the GUI doesn't show it" — the
      whole class of lying-field this fix exists to retire.
    - Edit form mirrors the create-modal chip control + pre-populates
      from provider.allowed_email_domains at startEdit time (defensive
      clone so chip mutations don't reach through into the cached
      TanStack Query data).
    - Save round-trips the trimmed list as `allowed_email_domains` in
      the PUT body alongside the other editable fields.
    - "Clear all" affordance with a confirm() dialog that warns about
      removing the tenant gate (cross-tenant logins permitted after
      save) — for operators who want to test enforcement-off then turn
      back on without retyping the full domain list.
    - Imports `validateEmailDomain` from OIDCProvidersPage for parity.

  web/src/api/client.ts
    - No changes — `allowed_email_domains?: string[]` was already in
      both OIDCProvider and OIDCProviderRequest types. The CRIT-5
      backend closure had already shipped the type but no GUI consumer
      ever used it.

Regression coverage (Vitest, all passing):

  OIDCProvidersPage.test.tsx (7 new):
    AllowedEmailDomains — Add persists a chip and is included in submit body
    AllowedEmailDomains — rejects entries containing @
    AllowedEmailDomains — rejects wildcard entries
    AllowedEmailDomains — normalizes mixed-case input to lowercase
    AllowedEmailDomains — Enter key adds the entry without clicking Add
    AllowedEmailDomains — chip × button removes the entry
    AllowedEmailDomains — duplicate entry is rejected

  validateEmailDomain unit suite (7 new):
    accepts a plain lowercase FQDN (with multi-label TLDs)
    rejects entries containing @ (with leading-@ variant)
    rejects entries with whitespace (with tab variant)
    rejects wildcards (with both *.x and x.* variants)
    rejects mixed-case
    rejects bare hostnames (no dot)
    rejects empty strings

  OIDCProviderDetailPage.test.tsx (5 new):
    AllowedEmailDomains — read-only view shows configured entries
    AllowedEmailDomains — read-only view shows "any" sentinel when empty
    AllowedEmailDomains — edit form pre-populates + PUT round-trips
    AllowedEmailDomains — removing a chip and saving submits the trimmed list
    AllowedEmailDomains — Add validates against backend rules

Verify gate green: `tsc --noEmit` clean across the web/ tree;
OIDCProvidersPage + OIDCProviderDetailPage suites pass all 29 tests
(19 + 10) — 13 of those are new A-3 cases, 16 were existing CRIT-5 /
Bundle 2 Phase 8 coverage. Three pre-existing test failures in
AuthSettingsPage.test.tsx + KeysPage.test.tsx confirmed unrelated
(reproduce on the base commit `661b6db` without any of this fix's
changes applied; not in scope for this CRIT fix).

Spec at cowork/auth-bundles-fixes-2026-05-11/03-crit-allowed-email-domains-gui.md
Closure annotation appended to CRIT-5 row of cowork/auth-bundles-audit-2026-05-10.md;
Lying-fields cross-reference table row #1 marked closed across both
the backend (CRIT-5, 2026-05-10) and GUI (A-3, 2026-05-11) legs.
Operator advisory in CHANGELOG.md v2.1.0 release notes — operators
who provisioned OIDC providers through the GUI between v2.1.0 and
this fix should verify allowed_email_domains matches their tenant
policy (the field was configurable only via API / MCP / direct SQL
during that window).

CHANGELOG.md

@@ -17,6 +17,25 @@
 
 ### Security
 
+- **OIDC `allowed_email_domains` now editable in the GUI (Audit 2026-05-11 A-3).**
+  The backend gate that rejects logins whose email domain is outside the
+  configured allowlist landed in v2.1.0 (CRIT-5 closure, 2026-05-10), but the
+  GUI never exposed the field — GUI-driven operators had to use the API
+  directly to configure tenant isolation against multi-tenant IdPs (Auth0,
+  Azure AD common endpoint, Google Workspace). The OIDCProvidersPage create
+  modal and OIDCProviderDetailPage detail view now render a chip-style
+  multi-input with client-side validation that mirrors the backend rules
+  (no `@`, no whitespace, no wildcards, lowercase-only FQDNs). The read-only
+  view renders an explicit "any (no gate configured)" sentinel when the list
+  is empty so operators can tell "not configured" apart from "field is
+  invisible." A "Clear all" button on the edit form is gated by a confirm
+  dialog that warns about removing the tenant gate. **Operator advisory: if
+  you provisioned OIDC providers via the GUI between v2.1.0 and this fix,
+  verify `allowed_email_domains` matches your tenant policy — the field was
+  configurable only via API / MCP / direct SQL during that window.** Per-IdP
+  runbooks for multi-tenant IdPs in `docs/operator/oidc-runbooks/` already
+  documented the field; the GUI now matches.
+
 - **Pre-login cookie Path widened from `/auth/oidc/` to `/` (Audit MED-14
   follow-on).** Required to satisfy the `__Host-` prefix's `Path=/` rule. The
   cookie lifetime is unchanged (10 minutes) and only the callback handler