Implement NK-WP-0021 activity-core ops SSO least-privilege.

Seed LLDAP activity-core-operators, add membership runbook and helper,
restrict Authelia access on activity/temporal.coulomb.social to that
group (member one_factor + domain deny fallback), apply live, and verify
via Authelia check-policy plus unauthenticated edge redirects.

sso-mfa/k8s/authelia/README.md

@@ -44,6 +44,36 @@ Key config points:
 - `identity_providers.oidc.clients[0].redirect_uris` — must match CP-NK-004 (`kc.coulomb.social`)
 - `session.domain` — set to parent domain `coulomb.social` so cookies are valid across
   both `auth.coulomb.social` and `kc.coulomb.social`
+- `access_control.default_policy: one_factor` — fleet default; MFA is not Authelia’s job
+- `access_control.rules` — domain allowlists by LLDAP group (see below)
+
+### Domain rules (app operator groups)
+
+Authelia evaluates `rules` top-down; **first match wins**. A rule that matches
+`domain` but not `subject` is skipped, so non-members would fall through to
+`default_policy` and stay allowed unless a later domain-only `deny` rule exists.
+
+Pattern used for activity-core public hosts (NK-WP-0021):
+
+```yaml
+access_control:
+  default_policy: one_factor
+  rules:
+    - domain: app.example.com
+      subject: "group:app-operators"
+      policy: one_factor
+    - domain: app.example.com
+      policy: deny
+```
+
+| Host | Required LLDAP group |
+|------|----------------------|
+| `activity.coulomb.social` | `activity-core-operators` |
+| `temporal.coulomb.social` | `activity-core-operators` |
+
+Membership: `sso-mfa/k8s/lldap/OPERATOR-GROUPS.md`. Do **not** set `two_factor`
+on these rules. Do **not** invent KeyCape OIDC clients for Traefik ForwardAuth
+apps — the edge already calls Authelia `/api/verify`.
 
 ## Secrets managed
 

sso-mfa/k8s/authelia/configmap.yaml

@@ -86,8 +86,26 @@ data:
     # ── Access control ────────────────────────────────────────────────────────
     # one_factor = password only. MFA is handled by KeyCape + privacyIDEA.
     # Do NOT change to two_factor here.
+    #
+    # Domain rules (NK-WP-0021): first matching rule wins. For restricted hosts
+    # put the group allow rule first, then a domain-wide deny so non-members do
+    # not fall through to default_policy (which would re-open the host).
+    # MFA stays KeyCape/privacyIDEA — policy remains one_factor, never two_factor.
     access_control:
       default_policy: one_factor
+      rules:
+        # activity-core ops console (ForwardAuth; no KeyCape OIDC client)
+        - domain: activity.coulomb.social
+          subject: "group:activity-core-operators"
+          policy: one_factor
+        - domain: activity.coulomb.social
+          policy: deny
+        # Temporal Web UI (same operator group)
+        - domain: temporal.coulomb.social
+          subject: "group:activity-core-operators"
+          policy: one_factor
+        - domain: temporal.coulomb.social
+          policy: deny
 
     # ── OIDC identity provider ────────────────────────────────────────────────
     # Authelia acts as an upstream OIDC provider for KeyCape.