feat(ory): OIDC group-to-team mapping, social login, Gitea OIDC-only mode

Identity permissions flow from Kratos metadata_admin.groups through
Hydra ID token claims to Gitea's OIDC group-to-team mapping:
- super-admin → site admin + Owners + Employees teams
- employee → Owners + Employees teams
- community → Contributors team (social sign-up users)

Kratos: Discord + GitHub social login providers, community identity
schema, OIDC method enabled with env-var credential injection via VSO.

Gitea: OIDC-only login (no local registration, no password form),
APP_NAME, favicon, auto-registration with account linking.

Also: messages-mta-in recreate strategy + liveness probe for milter.

base/lasuite/messages-mta-in-deployment.yaml

@@ -5,6 +5,10 @@ metadata:
   namespace: lasuite
 spec:
   replicas: 1
+  # Recreate: hostPort 25 blocks RollingUpdate — the new pod can't
+  # schedule while the old one still holds the port.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: messages-mta-in
@@ -31,6 +35,26 @@ spec:
                   key: MDA_API_SECRET
             - name: MAX_INCOMING_EMAIL_SIZE
               value: "30000000"
+          # Liveness: verify the delivery milter process is running and the
+          # unix socket exists. The milter is a long-lived Python process that
+          # can hang silently after days of uptime (COE-2026-002 addendum).
+          # Without this probe, postfix returns 451 to all inbound mail and
+          # nobody notices until senders complain.
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - "test -S /var/spool/postfix/milter/delivery.sock && kill -0 $(cat /var/run/milter.pid 2>/dev/null || pgrep -f delivery_milter.py)"
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            tcpSocket:
+              port: 25
+            initialDelaySeconds: 10
+            periodSeconds: 15
           securityContext:
             capabilities:
               add: ["NET_BIND_SERVICE"]