refactor(oidc): drop single-subject allowlist, authenticate-only (ADR-012)

ADR-011's single-user authz (ID-token subject must equal AllowedSubject,
else 403) is replaced by ADR-012's model: Dex authentication is the only
gate — any Dex-authenticated subject may establish a session. Whether that
subject has a tapir user, and routing to registration if not, is decided
downstream in internal/web (next commit).

Removals (noted): oidc.Config.AllowedSubject + its required-field check + the
callback 403 branch; config.Config.AllowedSubject + TAPIR_ALLOWED_SUBJECT env
wiring; the AllowedSubject arg in cmdServe. ui-spec.md updated to reflect the
supersession. Sessions, cookie signing, login/callback/logout unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/config/config.go

@@ -57,15 +57,14 @@ type Config struct {
 	// HTTPAddr is the listen address for `tapir serve` (the Stage-0 web UI).
 	HTTPAddr string
 
-	// Dex OIDC (web login, ADR-011). When OIDCIssuer is empty, `serve` falls back
-	// to the allow-all StubAuth (local dev). When set, serve uses Dex with
-	// single-user allowlist authz.
+	// Dex OIDC (web login, ADR-011/012). When OIDCIssuer is empty, `serve` falls
+	// back to the allow-all StubAuth (local dev). When set, serve uses Dex: any
+	// Dex-authenticated subject may sign in, then registers a tapir user (ADR-012).
 	OIDCIssuer      string
 	DexClientID     string
 	DexClientSecret string
 	OIDCRedirectURL string
 	SessionSecret   string
-	AllowedSubject  string
 }
 
 // DexConfigured reports whether Dex OIDC login is wired (issuer present). When
@@ -104,7 +103,6 @@ func Load() (Config, error) {
 		DexClientSecret:   os.Getenv("TAPIR_DEX_CLIENT_SECRET"),
 		OIDCRedirectURL:   os.Getenv("TAPIR_OIDC_REDIRECT_URL"),
 		SessionSecret:     os.Getenv("TAPIR_SESSION_SECRET"),
-		AllowedSubject:    os.Getenv("TAPIR_ALLOWED_SUBJECT"),
 	}
 
 	timeout, err := durationOr("TAPIR_SUMMARIZER_TIMEOUT", defaultSummarizerTimeout)