P2 cleanups: pin deps, prune job-run rows, unmask non-secret creds, enforce allowlist at login

- R11: pin requirements.txt to the versions running in the image, so a rebuild
  can't pull a breaking upstream release. Documented how to upgrade.
- R12: log rotation now also prunes job_runs rows older than 90 days (nulling
  the manual_imports FK reference first), so the table doesn't grow without
  bound. dedup/genre candidates are review state and left alone.
- U5: credential form shows non-secret fields (URLs, usernames, prefs) as plain
  text so they can be verified while typing; only real secrets stay masked.
  Dashboard IP card reworded from gluetun-specific to generic "Outbound IP".
- S9: enforce ALLOWED_EMAIL at the OIDC callback, before any user row or session
  is created, instead of only on later requests.

Verified: pinned build resolves; prune deletes only old rows and keeps the
manual_imports record; credentials page renders text+password inputs; a
disallowed email gets 403 with no user row, an allowed one succeeds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/routers/auth.py

@@ -1,6 +1,6 @@
 import time
 
-from fastapi import APIRouter, Request
+from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import RedirectResponse
 from sqlalchemy import select
 
@@ -8,6 +8,7 @@ from app.db import SessionLocal
 from app.models import User
 from app.security.oidc import oauth
 from app.services import diagnostics
+from app.settings import settings
 
 router = APIRouter(prefix="/auth", tags=["auth"])
 
@@ -33,6 +34,12 @@ async def auth_callback(request: Request):
     name = userinfo.get("name")
     now = time.time()
 
+    # Enforce the allowlist here, before creating any user row or session, so a
+    # disallowed identity never gets persisted or a cookie (require_auth also
+    # checks it on every request, but that's after the fact).
+    if settings.allowed_email and email != settings.allowed_email:
+        raise HTTPException(status_code=403, detail="This account is not authorized to use alembic.")
+
     with SessionLocal() as db:
         user = db.execute(select(User).where(User.oidc_sub == sub)).scalar_one_or_none()
         if user is None:

app/routers/credentials.py

@@ -30,6 +30,7 @@ async def credentials_index(request: Request, user: dict = Depends(require_auth)
             "scope_fields": credential_service.SCOPE_FIELDS,
             "scope_descriptions": credential_service.SCOPE_DESCRIPTIONS,
             "core_scopes": credential_service.CORE_SCOPES,
+            "secret_keys": credential_service.SECRET_KEYS,
             "configured": configured,
             "enabled": enabled,
             "key_present": crypto.key_present(),