OIDC groups implementation

- Add Groups field to User struct with JSON storage
- Include GetGroups() and SetGroups() helper methods
- Extract groups from OIDC claims in FromClaim()
- Add database migration 202509161200 for groups column
- Update config-example.yaml with groups scope
- Add comprehensive documentation and testing

hscontrol/db/db.go

@@ -932,6 +932,28 @@ AND auth_key_id NOT IN (
 				},
 				Rollback: func(db *gorm.DB) error { return nil },
 			},
+			// Add Groups column to users table for OIDC role-based access control
+			{
+				ID: "202509161200",
+				Migrate: func(tx *gorm.DB) error {
+					// Add Groups column to store OIDC group memberships as JSON
+					if !tx.Migrator().HasColumn(&types.User{}, "groups") {
+						err := tx.Migrator().AddColumn(&types.User{}, "groups")
+						if err != nil {
+							return fmt.Errorf("adding groups column to users table: %w", err)
+						}
+						log.Info().Msg("Added Groups column to users table for OIDC role mapping")
+					}
+					return nil
+				},
+				Rollback: func(db *gorm.DB) error {
+					// Remove Groups column on rollback
+					if tx.Migrator().HasColumn(&types.User{}, "groups") {
+						return tx.Migrator().DropColumn(&types.User{}, "groups")
+					}
+					return nil
+				},
+			},
 			// From this point, the following rules must be followed:
 			// - NEVER use gorm.AutoMigrate, write the exact migration steps needed
 			// - AutoMigrate depends on the struct staying exactly the same, which it won't over time.