feat: OIDC/LDAP auth, audit log, maintenance windows, migrations

- Add OIDC (OpenID Connect) authentication with discovery URL support,
  group-based role mapping, and token introspection
- Add LDAP authentication with bind credentials, group-based role
  mapping, and configurable attribute names
- Add audit log (model, routes, templates) tracking settings changes,
  plugin enable/disable, login events
- Add migrations 0009 (widget variants), 0010 (maintenance windows),
  0011 (audit log)
- Add optional dependency groups to pyproject.toml: [ldap], [snmp]
- Add Settings → Auth tab with OIDC and LDAP configuration forms

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fabledscryer/core/settings.py

@@ -51,6 +51,35 @@ DEFAULTS: dict[str, Any] = {
     "ping.threshold.good_ms": 50,
     "ping.threshold.warn_ms": 200,
     "plugins.index_url": "https://git.fabledsword.com/bvandeusen/FabledScryer-plugins/raw/branch/main/index.yaml",
+    # OIDC single-sign-on
+    "oidc.enabled": False,
+    "oidc.discovery_url": "",
+    "oidc.client_id": "",
+    "oidc.client_secret": "",
+    "oidc.scopes": "openid profile email",
+    "oidc.username_claim": "preferred_username",
+    "oidc.email_claim": "email",
+    "oidc.groups_claim": "groups",
+    "oidc.admin_group": "",
+    "oidc.operator_group": "",
+    # LDAP authentication
+    "ldap.enabled": False,
+    "ldap.host": "",
+    "ldap.port": 389,
+    "ldap.tls": False,
+    "ldap.bind_dn": "",
+    "ldap.bind_password": "",
+    "ldap.base_dn": "",
+    "ldap.user_filter": "(uid={username})",
+    "ldap.admin_group_dn": "",
+    "ldap.operator_group_dn": "",
+    "ldap.attr_username": "uid",
+    "ldap.attr_email": "mail",
+    # Scheduled reports
+    "reports.enabled": False,
+    "reports.schedule_day": 6,   # 0=Monday … 6=Sunday
+    "reports.schedule_hour": 8,  # UTC hour
+    "reports.last_sent_at": "",
 }
 
 
@@ -123,6 +152,14 @@ def to_ansible_cfg(settings: dict[str, Any]) -> dict:
     return {"sources": settings.get("ansible.sources", [])}
 
 
+def to_oidc_cfg(settings: dict[str, Any]) -> dict:
+    return {k[len("oidc."):]: settings.get(k, DEFAULTS[k]) for k in DEFAULTS if k.startswith("oidc.")}
+
+
+def to_ldap_cfg(settings: dict[str, Any]) -> dict:
+    return {k[len("ldap."):]: settings.get(k, DEFAULTS[k]) for k in DEFAULTS if k.startswith("ldap.")}
+
+
 def to_plugins_cfg(settings: dict[str, Any]) -> dict:
     """Assemble {plugin_name: {...config}} from all plugin.* keys."""
     result = {}