feat: mount gakudan_liveboard dashboard behind OIDC auth

[Taure]

Embeds the gakudan_liveboard live console in triagebot, gated by Google OIDC login + an email-domain allowlist so the dashboard is not public ("not everyone can log in").

What's in it

• bump gakudan v0.1.3 → v0.1.30; add gakudan_liveboard, datastar, telemetry, nova_auth_oidc deps + app entries
• triagebot_oidc_config — nova_auth_oidc provider config from env (TRIAGEBOT_OIDC_CLIENT_ID/SECRET, TRIAGEBOT_OIDC_ISSUER, TRIAGEBOT_BASE_URL)
• triagebot_dashboard_auth — route security: no session → 302 login, email domain not in TRIAGEBOT_DASHBOARD_ALLOWED_DOMAINS → 403, else allow (empty allowlist = any authenticated user)
• triagebot_auth_controller — adapts binary-keyed route bindings to the atom provider key nova_auth_oidc_controller expects
• triagebot_router — public /auth/:provider/{login,callback} + self-hosted /assets (served from gakudan_liveboard's priv), protected dashboard route group
• triagebot_app:start — ensure_providers only when OIDC creds are set, else logs that login is inert
• relx exclude_modules to resolve the nova_auth / nova_auth_oidc duplicate-module collision

Verified end-to-end (running release)

unauth / → 302 /auth/google/login · /auth/google/login → 302 to accounts.google.com with PKCE · authed run index 200, run detail 200, live SSE transcript streaming · self-hosted assets 200 (GDPR).

Tests

triagebot_dashboard_auth_SUITE (10 cases: auth decision, allowlist, binding adapter, OIDC config). Full suite: 30 passing. fmt/xref clean.

Run it

Set OIDC env (TRIAGEBOT_OIDC_CLIENT_ID/SECRET, TRIAGEBOT_BASE_URL) + TRIAGEBOT_DASHBOARD_ALLOWED_DOMAINS; Google redirect URI = <base>/auth/google/callback. Without OIDC creds the board still mounts but login is inert.

Two upstream issues worked around (flagged for novaframework/*)

1. nova_auth still ships the pre-extraction nova_auth_oidc/_jwt stub modules → collide with the dedicated nova_auth_oidc app (worked around via relx exclude_modules).
2. nova_auth_oidc_controller matches an atom provider binding, but Nova keys bindings as binaries → 500 (worked around via triagebot_auth_controller).

Follow-ups

• merge gakudan_liveboard design/conductor-console → main + tag, then pin a tag here instead of the branch
• the two upstream nova_auth_oidc fixes

[github-actions]

🔴 Code Coverage — 23%

59 of 257 lines covered.

---

✅ ELP Lint

No diagnostics.