feat: Microsoft Entra authentication for Temporal (server JWT + UI OIDC)

[bmorton]

Wires Microsoft Entra into Temporal for both service-to-service JWT auth and
human UI login, building on the passwordless Entra work from #85. Stock
temporalio/server and temporalio/ui images throughout — no custom claim
mapper or image.

What's included

Server JWT auth (spec.authorization)

• Typed entra.tenantID shortcut that derives the Entra JWKS URL
  (https://login.microsoftonline.com/<tenant>/discovery/v2.0/keys), plus
  explicit jwtKeyProvider.keySourceURIs / refreshInterval and
  permissionsClaimName (defaults to roles when entra is set — Entra app
  roles land in the roles claim).
• authorizer is now a *string: unset → defaults to "default"
  (per-namespace RBAC) when JWT is configured; "" → Temporal's no-op
  authorizer for authenticate-only mode. Both modes are first-class.
• The previously-dead authorization.config passthrough is now rendered (and
  cleanly overrides modeled keys, incl. jwtKeyProvider, with no duplicate YAML).

UI OIDC login (spec.ui.auth)

• Replaces the unused ui.auth raw passthrough with a typed UIAuthSpec:
  enabled, entra.tenantID, providerURL, clientID, clientSecretRef,
  scopes, callbackURL, extraEnv — rendered as TEMPORAL_AUTH_* env on the
  UI Deployment. The client secret is sourced via secretKeyRef and never
  inlined.

Validation, docs, example, tests

• Webhook validation of ui.auth (required fields; exactly one provider source;
  extraEnv must be a string map).
• New guide: docs/content/operations/authentication.md (authn-only + RBAC via
  Entra app roles, UI OIDC, the longstanding app, security caveats),
  cross-linked from the Azure install guide. Regenerated CRD/API reference,
  mirrored into dist/chart.
• Example examples/cluster-entra-auth/ using a 1Password OnePasswordItem for
  the UI client secret.
• Hermetic JWKS server-JWT e2e (test/e2e/entra-auth/, Chainsaw on kind, no
  Azure): an offline RSA keypair + static JWKS, baked valid/invalid JWTs, proves
  a valid <namespace>:<role> token is authorized and missing/wrong-signature
  tokens are rejected — with the denial checks gated on the validator being
  demonstrably live.
• hack/entra-e2e.sh (+ make entra-e2e-up/-token/-down) creates a longstanding
  Entra app registration (app roles default:read/default:write/
  temporal-system:admin) for manual real-Entra verification.

Breaking change

spec.ui.auth changes from raw YAML to a typed object. The field was previously
dead (never rendered), and the project is pre-1.0.

Validation

make build, make test, make lint (0 issues), and make generate manifests
(no drift) all pass. The hermetic e2e suite's crypto is verified offline; the
live kind run is documented (not run in this environment).

Design + plan:
docs/superpowers/specs/2026-06-21-entra-authentication-design.md,
docs/superpowers/plans/2026-06-21-entra-authentication.md.