feat(positions): add flexible shared-terminal staffing

[windischb]

Motivation

Complete the flexible position-terminal model defined by ADR 0003: configurable activation proofs and device bindings, multi-position terminals, lifecycle-safe staffing sessions, and explicit step-up semantics. The feature remains opt-in through PositionTerminals.

Surface touched

• Authentication slice (Modgud.Authentication/)
• Authorization slice (Modgud.Authorization/)
• OAuth/OIDC server (OpenIddict, /connect/*, OAuth aggregates)
• Admin API
• Admin SPA (src/frontend-vue/)
• Realm settings
• Docs (docs/)
• Other: position-terminal domain, Marten projections, lifecycle cascades and integration events

What changed

• Adds configurable activation methods and realm security floors.
• Adds DPoP, client-secret and unbound terminal binding modes.
• Moves new enrollments to Control Token V2 (sub = terminalId) while retaining bounded Control V1 compatibility.
• Supports one terminal assigned to multiple compatible positions with post-proof position selection.
• Adds position-owned activation tokens, policy revalidation, immediate lifecycle cascades, local lock and action/nonce-bound step-up.
• Extends the admin UI for staffing clients, terminal configuration and position security settings.
• Keeps PositionTerminals disabled by default; enable explicitly with AppSettings__Features__PositionTerminals=true.

Tests

• Unit tests added / updated for the changed code
• Integration tests added / updated where applicable
• Release unit suite: 1522/1522
• Release API integration suite: 691/691
• Post-hardening Positions suite: 85/85
• Default-off feature-flag contract: 1/1
• Frontend typecheck and production build
• Chromium staffing-client UI E2E: 1/1
• Public and in-app VitePress builds
• Upgrade rehearsal against a clone of the stable database on postgres-dev:5433

Docs

• Consumer contract updated (docs/integrate/position-terminals.md)
• Admin guide and concept scenarios updated
• Feature-flag guide updated
• Roadmap and changelog updated

Breaking changes

• No unguarded breaking changes

New enrollments use Control V2. Existing V1 chains remain accepted for their original singleton assignment under the documented transition window. The complete surface is behind a default-off feature flag.

Notes

The stable shared Docker environment was not used for development or migration rehearsal. Development and upgrade rehearsal used postgres-dev on host port 5433 only.