Implement NK-WP-0021 activity-core ops SSO least-privilege.

Seed LLDAP activity-core-operators, add membership runbook and helper,
restrict Authelia access on activity/temporal.coulomb.social to that
group (member one_factor + domain deny fallback), apply live, and verify
via Authelia check-policy plus unauthenticated edge redirects.

sso-mfa/k8s/authelia/README.md

@@ -44,6 +44,36 @@ Key config points:
 - `identity_providers.oidc.clients[0].redirect_uris` — must match CP-NK-004 (`kc.coulomb.social`)
 - `session.domain` — set to parent domain `coulomb.social` so cookies are valid across
   both `auth.coulomb.social` and `kc.coulomb.social`
+- `access_control.default_policy: one_factor` — fleet default; MFA is not Authelia’s job
+- `access_control.rules` — domain allowlists by LLDAP group (see below)
+
+### Domain rules (app operator groups)
+
+Authelia evaluates `rules` top-down; **first match wins**. A rule that matches
+`domain` but not `subject` is skipped, so non-members would fall through to
+`default_policy` and stay allowed unless a later domain-only `deny` rule exists.
+
+Pattern used for activity-core public hosts (NK-WP-0021):
+
+```yaml
+access_control:
+  default_policy: one_factor
+  rules:
+    - domain: app.example.com
+      subject: "group:app-operators"
+      policy: one_factor
+    - domain: app.example.com
+      policy: deny
+```
+
+| Host | Required LLDAP group |
+|------|----------------------|
+| `activity.coulomb.social` | `activity-core-operators` |
+| `temporal.coulomb.social` | `activity-core-operators` |
+
+Membership: `sso-mfa/k8s/lldap/OPERATOR-GROUPS.md`. Do **not** set `two_factor`
+on these rules. Do **not** invent KeyCape OIDC clients for Traefik ForwardAuth
+apps — the edge already calls Authelia `/api/verify`.
 
 ## Secrets managed