XiaoSeS 75c7f9a880 feat(deploy): wire DingTalk credentials into the release surfaces ... Adds the DingTalk credentials to every path that actually delivers configuration: compose.release.yml (which has no env_file, so variables must be listed explicitly), the Helm secret template and values, the k8s deployment and its secret example. validate-release-config.sh gains DingTalk in its provider loop, so a half-configured pair is rejected the same way. Documents the three-stage strategy contract in the authentication design: a table mapping each deviation -- authorize parameters, token exchange, userinfo loading -- to its interface and current implementations, plus the rule that a provider must never make account decisions itself. Deployment notes and both FAQs now cover DingTalk, including the shared trap with Feishu: their emails are admin-recorded and never confirmed, so emailVerified is always false and an EMAIL_DOMAIN access policy would reject every login through either provider. Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>		2026-09-21 15:15:41 +08:00
..
k8s	feat(deploy): wire DingTalk credentials into the release surfaces	2026-09-21 15:15:41 +08:00
runtime-mirror-images.txt	fix(deploy): pull MinIO from Quay	2026-09-13 14:52:40 +08:00
skillhub-ingress.yaml	Fix phase1 auth flow gaps	2026-03-12 00:26:33 +08:00