refactor(oidc): drop single-subject allowlist, authenticate-only (ADR-012)

ADR-011's single-user authz (ID-token subject must equal AllowedSubject,
else 403) is replaced by ADR-012's model: Dex authentication is the only
gate — any Dex-authenticated subject may establish a session. Whether that
subject has a tapir user, and routing to registration if not, is decided
downstream in internal/web (next commit).

Removals (noted): oidc.Config.AllowedSubject + its required-field check + the
callback 403 branch; config.Config.AllowedSubject + TAPIR_ALLOWED_SUBJECT env
wiring; the AllowedSubject arg in cmdServe. ui-spec.md updated to reflect the
supersession. Sessions, cookie signing, login/callback/logout unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/ui-spec.md

@@ -77,8 +77,9 @@ summary_actions
 - **Flow:** standard Authorization Code. Use `coreos/go-oidc` + `golang.org/x/oauth2`
   (justify the deps in the commit; both are the homelab-standard OIDC libs and small).
 - Discover issuer `https://auth.d-ma.be` (`TAPIR_OIDC_ISSUER`); scopes `openid profile email`.
-- On callback: verify ID token, extract `sub` (and email); **allowlist check** against
-  `TAPIR_ALLOWED_SUBJECT` (the maintainer's Dex subject) — reject everyone else with 403.
+- On callback: verify ID token, extract `sub` (and email). **ADR-012 superseded the
+  ADR-011 single-subject allowlist:** any Dex-authenticated subject may sign in; a subject
+  with no tapir user is routed to explicit registration (see `internal/web` registration gate).
 - **Session:** signed, httpOnly, Secure cookie (HS256 with `TAPIR_SESSION_SECRET`); short TTL
   + sliding refresh. Server-side session store can be in-memory at Stage 0 (single replica).
 - **Middleware** guards every route except `/healthz` and `/auth/*`.
@@ -89,8 +90,9 @@ summary_actions
 
 `TAPIR_HTTP_ADDR` (`:8080`), `TAPIR_PUBLIC_URL` (`https://tapir.d-ma.be`),
 `TAPIR_OIDC_ISSUER` (`https://auth.d-ma.be`), `TAPIR_DEX_CLIENT_ID`, `TAPIR_DEX_CLIENT_SECRET`,
-`TAPIR_OIDC_REDIRECT_URL` (`https://tapir.d-ma.be/auth/callback`), `TAPIR_SESSION_SECRET`,
-`TAPIR_ALLOWED_SUBJECT`. Reuses existing `TAPIR_DB_DSN`, `TAPIR_USER_ID`. No secrets committed.
+`TAPIR_OIDC_REDIRECT_URL` (`https://tapir.d-ma.be/auth/callback`), `TAPIR_SESSION_SECRET`.
+Reuses existing `TAPIR_DB_DSN`, `TAPIR_USER_ID` (the StubAuth dev subject only). No secrets
+committed. (`TAPIR_ALLOWED_SUBJECT` was removed by ADR-012.)
 
 ## 8. Deployment — k3s + Flux GitOps
 
@@ -117,7 +119,7 @@ summary_actions
 
 1. **Register a Dex static client** `tapir-web` in the Dex config (in `infra`) with redirect
    `https://tapir.d-ma.be/auth/callback`; client id/secret → 1P `TAPIR_DEX_CLIENT_ID` /
-   `TAPIR_DEX_CLIENT_SECRET`. Capture your Dex `sub` for `TAPIR_ALLOWED_SUBJECT`.
+   `TAPIR_DEX_CLIENT_SECRET`. (No allowlist subject to capture — ADR-012 dropped it.)
 2. **DNS/edge** for `tapir.d-ma.be` → the k3s ingress (piguard NPM perimeter / existing
    `*.d-ma.be` pattern) + TLS cert.
 3. Confirm the **registry** host/path the gitea CI pushes to and the Flux path