auth: OpenID session check, live Keycloak test, sign-in guide (S3)

Spec 12 S3: job oidcCheck refreshes every OpenID session at the provider every 15 minutes and
applies groups and role again; invalid_grant ends the session, an outage doesn't. A live test
makes a throwaway Keycloak realm and signs in through its login form (passed against 26.8.1).
NODE_EXTRA_CA_CERTS for a private CA. Admin guide: docs/admin-guide/sign-in.md.

docs/admin-guide/README.md

@@ -12,6 +12,7 @@ keeping the system safe, legal and up to date.
 7. [Analog phones (ATAs)](ata.md)
 8. [Local AI](ai.md): voicemail transcripts
 9. [Contacts](contacts.md): the builtin phonebook, or Contrack
+10. [Sign-in](sign-in.md): passwords, and OpenID Connect (Keycloak and others)
 
 ---