Implement NK-WP-0021 activity-core ops SSO least-privilege.

Seed LLDAP activity-core-operators, add membership runbook and helper,
restrict Authelia access on activity/temporal.coulomb.social to that
group (member one_factor + domain deny fallback), apply live, and verify
via Authelia check-policy plus unauthenticated edge redirects.

sso-mfa/k8s/authelia/configmap.yaml

@@ -86,8 +86,26 @@ data:
     # ── Access control ────────────────────────────────────────────────────────
     # one_factor = password only. MFA is handled by KeyCape + privacyIDEA.
     # Do NOT change to two_factor here.
+    #
+    # Domain rules (NK-WP-0021): first matching rule wins. For restricted hosts
+    # put the group allow rule first, then a domain-wide deny so non-members do
+    # not fall through to default_policy (which would re-open the host).
+    # MFA stays KeyCape/privacyIDEA — policy remains one_factor, never two_factor.
     access_control:
       default_policy: one_factor
+      rules:
+        # activity-core ops console (ForwardAuth; no KeyCape OIDC client)
+        - domain: activity.coulomb.social
+          subject: "group:activity-core-operators"
+          policy: one_factor
+        - domain: activity.coulomb.social
+          policy: deny
+        # Temporal Web UI (same operator group)
+        - domain: temporal.coulomb.social
+          subject: "group:activity-core-operators"
+          policy: one_factor
+        - domain: temporal.coulomb.social
+          policy: deny
 
     # ── OIDC identity provider ────────────────────────────────────────────────
     # Authelia acts as an upstream OIDC provider for KeyCape.