feat: implement Crove Sign deployment, OIDC SSO, and Hybrid Org Sync

[JOY (JOY)]

Summary

• Infrastructure & Deployment: Add standalone docker-compose configuration for Crove Sign on VM (crover-server / crove-os).
• Database Schema Isolation: Fix Prisma migrations to eliminate hardcoded public schema references and support isolated custom schemas (sign).
• SSO-First Authentication: Enable native OpenID Connect (OIDC) via DOS.Me ID (id.dos.me) with PKCE and auto-account linking.
• Phase 1 JIT Sync: Auto-sync Avatar from URL, sync Display Name, and JIT provision organizations/teams on OIDC login/link.
• Phase 2 Real-Time Webhook: Add /api/webhooks/dos-org-sync endpoint with HMAC-SHA256 signature verification (X-DOS-Signature) for real-time organization, membership, and user profile synchronization.
• System Architecture: Provide comprehensive architecture documentation in docs/ARCHITECTURE.md.

Test plan

• Verified compose configuration format and schema.
• Verified deployment directory and container startup on VM.
• Verified Supabase isolated schema sign database access and 163 migrations.
• Verified OIDC login redirect flow to DOS ID.
• Verified JIT Profile/Avatar and Org sync handlers.
• Verified HMAC-SHA256 signature validation logic.

---

Note

High Risk
Touches OIDC login, org membership, and org deletion via a new webhook. Signature checks are skipped when the webhook secret is unset, and architecture docs include live infra identifiers.

Overview
Adds hybrid DOS.Me identity sync: OIDC callbacks now pull avatar and org claims and JIT-provision users, orgs, memberships, and a default team. A new POST /api/webhooks/dos-org-sync handler applies create/update/delete and member events (HMAC-SHA256 when a secret is set).

Also ships Crove deploy pieces: GHCR image workflow, compose for crove-sign, Docker heap bump, Prisma migrations that work on a non-public sign schema, and architecture/runbook docs.

^{Reviewed by Cursor Bugbot for commit 5e56e5d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_543c2ea9-7a9f-4859-8a1f-a514cad6b496)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_d82a5141-200c-4a34-8eeb-7e8bfe18d784)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_257b1bc4-105b-4558-a09a-705bf1ce843f)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a03da9fa-b8bd-4cad-be9d-5af5f9b1aa9d)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_65e0991d-70f3-4cb0-972a-4d00d1b66d32)