Identity permissions flow from Kratos metadata_admin.groups through
Hydra ID token claims to Gitea's OIDC group-to-team mapping:
- super-admin → site admin + Owners + Employees teams
- employee → Owners + Employees teams
- community → Contributors team (social sign-up users)
Kratos: Discord + GitHub social login providers, community identity
schema, OIDC method enabled with env-var credential injection via VSO.
Gitea: OIDC-only login (no local registration, no password form),
APP_NAME, favicon, auto-registration with account linking.
Also: messages-mta-in recreate strategy + liveness probe for milter.
Sienna Meridian Satterwhite
97628b0f6f
