OIDC groups implementation

- Add Groups field to User struct with JSON storage
- Include GetGroups() and SetGroups() helper methods
- Extract groups from OIDC claims in FromClaim()
- Add database migration 202509161200 for groups column
- Update config-example.yaml with groups scope
- Add comprehensive documentation and testing

docker-dev/headplane-config-oidc.yaml

@@ -0,0 +1,31 @@
+headscale:
+  url: "http://headscale:8080"
+  api_key: "headscale-api-key"
+
+oidc:
+  enabled: true
+  issuer_url: "http://keycloak:8080/realms/headscale"
+  client_id: "headplane-client"
+  client_secret: "headplane-client-secret"
+  scope: "openid profile email groups"
+  redirect_uri: "http://localhost:3000/admin/oidc/callback"
+  extra_params:
+    prompt: "select_account"
+  profile_picture_source: "oidc"
+  # For testing purposes, use the same API key for all users
+  # In production, you'd want proper API key management per user
+  headscale_api_key: "headscale-api-key"
+
+# Group to role mapping configuration
+role_mapping:
+  owner: ["headscale-owner", "owner"]
+  admin: ["headscale-admin", "admin", "administrators"]
+  network_admin: ["headscale-network", "network-admin"]
+  it_admin: ["headscale-it", "it-admin"]
+  auditor: ["headscale-audit", "auditor"]
+
+integration:
+  provider: "docker"
+
+log:
+  level: "info"