Add RBAC with role-based endpoint authorization and OIDC support

Implement three-phase security upgrade:

Phase 1 - RBAC: Extend JWT with roles claim, populate Spring
GrantedAuthority in filter, enforce role-based access (AGENT for
data/heartbeat/SSE, VIEWER+ for search/diagrams, OPERATOR+ for
commands, ADMIN for user management). Configurable JWT secret via
CAMELEER_JWT_SECRET env var for token persistence across restarts.

Phase 2 - User persistence: ClickHouse users table with
ReplacingMergeTree, UserRepository interface + ClickHouse impl,
UserAdminController for CRUD at /api/v1/admin/users. Local login
upserts user on each authentication.

Phase 3 - OIDC: Token exchange flow where SPA sends auth code,
server exchanges it server-side (keeping client_secret secure),
validates id_token via JWKS, resolves roles (DB override > OIDC
claim > default), issues internal JWT. Conditional on
CAMELEER_OIDC_ENABLED=true. Uses oauth2-oidc-sdk for standards
compliance.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/resources/clickhouse/03-users.sql

@@ -0,0 +1,10 @@
+CREATE TABLE IF NOT EXISTS users (
+    user_id       String,
+    provider      LowCardinality(String),
+    email         String DEFAULT '',
+    display_name  String DEFAULT '',
+    roles         Array(LowCardinality(String)),
+    created_at    DateTime64(3, 'UTC') DEFAULT now64(3, 'UTC'),
+    updated_at    DateTime64(3, 'UTC') DEFAULT now64(3, 'UTC')
+) ENGINE = ReplacingMergeTree(updated_at)
+ORDER BY (user_id);