refactor(oidc): drop single-subject allowlist, authenticate-only (ADR-012)

ADR-011's single-user authz (ID-token subject must equal AllowedSubject,
else 403) is replaced by ADR-012's model: Dex authentication is the only
gate — any Dex-authenticated subject may establish a session. Whether that
subject has a tapir user, and routing to registration if not, is decided
downstream in internal/web (next commit).

Removals (noted): oidc.Config.AllowedSubject + its required-field check + the
callback 403 branch; config.Config.AllowedSubject + TAPIR_ALLOWED_SUBJECT env
wiring; the AllowedSubject arg in cmdServe. ui-spec.md updated to reflect the
supersession. Sessions, cookie signing, login/callback/logout unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

cmd/tapir/main.go

@@ -164,18 +164,17 @@ func cmdServe(ctx context.Context, log *slog.Logger) error {
 	defer st.Close()
 
 	// Auth seam (handlers depend on web.Auth only). With Dex configured
-	// (TAPIR_OIDC_ISSUER set) serve uses real OIDC login with single-user
-	// allowlist authz (ADR-011); otherwise it falls back to the allow-all
-	// StubAuth for local dev — never expose StubAuth publicly.
+	// (TAPIR_OIDC_ISSUER set) serve uses real OIDC login — any Dex subject may
+	// authenticate, then registers a tapir user (ADR-012); otherwise it falls
+	// back to the allow-all StubAuth for local dev — never expose StubAuth publicly.
 	var authn web.Auth
 	if cfg.DexConfigured() {
 		authn, err = oidc.New(ctx, oidc.Config{
-			Issuer:         cfg.OIDCIssuer,
-			ClientID:       cfg.DexClientID,
-			ClientSecret:   cfg.DexClientSecret,
-			RedirectURL:    cfg.OIDCRedirectURL,
-			SessionSecret:  cfg.SessionSecret,
-			AllowedSubject: cfg.AllowedSubject,
+			Issuer:        cfg.OIDCIssuer,
+			ClientID:      cfg.DexClientID,
+			ClientSecret:  cfg.DexClientSecret,
+			RedirectURL:   cfg.OIDCRedirectURL,
+			SessionSecret: cfg.SessionSecret,
 		})
 		if err != nil {
 			return fmt.Errorf("dex oidc: %w", err)