M21: add optional organisation identity

docs/17-runbook.md

@@ -50,6 +50,22 @@ uses HTTPS, and keep `INITIAL_ADMIN_PASSWORD` out of Git and logs. Existing sess
 revalidated against the current user record on every request, so deactivating an account
 invalidates its next request.
 
+### Optional organisation login (OIDC)
+
+OpenID Connect can coexist with the public demo. Set `OIDC_ENABLED=true`, issuer URL,
+client ID and client secret; register
+`<MOBILITYOPS_PUBLIC_URL>/api/v1/auth/oidc/callback` at the identity provider. The login
+screen then adds an organisation-login action without removing either public demo role.
+State and nonce validation use a short-lived signed HttpOnly cookie. Identity binding is
+unique on issuer plus `sub`; only a verified email is accepted. Optionally restrict
+domains with `OIDC_ALLOWED_EMAIL_DOMAINS`. New identities receive the least-privileged
+`rental_employee` role by default and can subsequently be promoted by an Operations
+Manager. Set `OIDC_AUTO_PROVISION=false` when every account must be pre-created.
+
+OIDC must use HTTPS outside a trusted local network. Set `SESSION_COOKIE_SECURE=true` and
+keep `OIDC_CLIENT_SECRET` in the deployment secret store. Disabling OIDC immediately
+removes the organisation-login action but does not affect public demo access.
+
 ## n8n automation (one-time per environment)
 
 The optional bundled fallback image (`n8nio/n8n:2.33.7`) requires an owner account before any