Restore access to unmapped accounts and configure federated login

[ctfbruce]

Historical accounts with no credentials or linked provider identity can now regain access through an explicitly approved host-administrator recovery. The command records a private support-case reference, writes a one-use 24-hour recovery code to an absent 0600 file in an owned 0700 directory, and revokes existing sessions. The existing recovery endpoint consumes the code and audit record atomically. Account IDs, roles and resource ownership stay unchanged; there is no public claim route or UUID/email-based ownership proof. Failed file publication rolls back issuance, and an uncertain commit preserves the private output with explicit inspection/revocation instructions.

Managed deployments can now render opt-in CILogon and browser-assisted CLI authentication settings, load the private provider environment file, and refresh the dispatcher unit when enabling, disabling or rotating provider credentials. A discovery outage now returns users to the existing sign-in error flow. Tests cover provider outages, recovery without restart, and preserving the old browser session until reauthentication succeeds.

References #226, #223 and #227. Dispatcher schema 20 requires the existing explicit stopped-service database upgrade; the migration adds recovery audit metadata without changing existing ownership. CILogon remains disabled by default, and existing GitHub configuration is preserved. Real provider registration, staging login acceptance and hosted cutover are not performed by this change.

Validation: complete dispatcher command, API, database and storage-check packages pass under the race detector on Linux. An owned native-TLS dispatcher rehearsal passed issuance, output-failure rollback, revocation/reissue, successful recovery, replay refusal, unchanged account/executor ownership and restart persistence. The offline Ansible rendering/update fixture passes 174 checks, including secret placement, rotation, disablement and absence of secret values in logs. Independent recovery and deployment source reviews found no P1/P2 issues. All 16 checks pass in candidate CI run 37012519490. No deployment is included.

Composition with the CILogon production deployment on main (#366): the merged deployment keeps main's variable names, production enablement, credential preflight and example file, and adds the browser-approved CLI authentication settings, the issuer and URL checks, the configuration-update refresh and the extended render fixture; the duplicate example file was dropped. The Go, SQL and documentation changes are unchanged from the previously validated head. The render fixture passed inside the pinned provisioner against a retained package (177 checks, none failing). Candidate CI on 5428cf7: https://github.com/netsec-ethz/debuglet/actions/runs/37278778224.