GitHub OAuth + email allowlist. No invite → 403.
Needs GITHUB_CLIENT_ID / SECRET in .env
ALLOW_DEV_LOGIN=1 only. Email must be allowlisted.