feat(config): add [web]/[web.oidc] config + operations/audit.py (W3)

config.example.toml

@@ -72,3 +72,38 @@ type = "workstation"
 enabled        = true
 # root         = "/var/lib/ci/cache/cargo"
 retention_days = 30
+
+# --------------------------------------------------------------------- web UI
+# Optional management web UI (`ci web serve`). Disabled unless `enabled = true`.
+# Server-rendered dashboard for VM/host management, auth'd via Gitea OIDC.
+#
+# SECURITY:
+#   * `bind_host` defaults to 127.0.0.1 (localhost only). Only set it to a
+#     LAN IP explicitly and deliberately -- never "0.0.0.0" (that exposes the
+#     dashboard, which can kill VMs and purge caches, to every network the
+#     host is reachable from).
+#   * `session_secret_cred` and `[web.oidc] client_secret_cred` below are
+#     KEYRING KEY NAMES, not the secrets themselves. The actual secret
+#     values are never written to this file -- set them with:
+#       ci creds set WebSessionSecret
+#       ci creds set WebOidcClientSecret
+#     (the `_cred` values here just tell the app which keyring entry to read
+#     at request time).
+#
+# [web]
+# enabled             = true
+# bind_host           = "192.168.1.50"   # explicit LAN IP; never 0.0.0.0
+# bind_port           = 8800
+# audit_log           = "/var/lib/ci/logs/web-audit.jsonl"
+# allowed_users       = ["simone"]        # Gitea usernames allowed to log in
+# session_secret_cred = "WebSessionSecret" # keyring KEY NAME, not the secret
+#
+# Gitea OIDC client registration: Gitea -> Settings -> Applications -> OAuth2,
+# redirect URI must exactly match `redirect_url` below (host+port+path).
+#
+# [web.oidc]
+# issuer              = "https://gitea.lan"
+# client_id           = "ci-web"
+# redirect_url        = "http://192.168.1.50:8800/auth/callback"
+# client_secret_cred  = "WebOidcClientSecret" # keyring KEY NAME, not the secret
+# scopes              = ["openid", "profile"]