Empty server.oidc.adminRole/userRole silently enables RBAC instead of authentication-only mode

User Story

As a cluster operator, I want to deploy OpenShell gateway in auth-only mode.

Problem Statement

values.yaml documents authentication-only mode thusly:

    # -- Role name for admin access. Leave empty (with userRole also empty) for
    # authentication-only mode. Both must be set or both empty.
    adminRole: ""
    # -- Role name for standard user access.
    userRole: ""

But the chart guards both keys on truthiness:

{{- if .Values.server.oidc.adminRole }}
admin_role    = {{ .Values.server.oidc.adminRole | quote }}
{{- end }}

so empty strings are omitted from the rendered TOML rather than emitted as "". OidcConfig then applies #[serde(default = "default_admin_role")], restoring openshell-admin / openshell-user. The gateway starts in RBAC mode with the stock role names.

Impact / Why This Matters

The chart provides no way to deploy in auth-only mode and its documentation is misleading.

Acceptance Criteria

• Documentation is changed to reflect actual chart behavior.
• Method to deploy in auth-only mode is added to the chart.

Reproduction Steps

1. Install the chart with server.oidc.issuer set and server.oidc.adminRole / server.oidc.userRole left at their "" defaults.
2. kubectl -n openshell get cm openshell-config -o yaml — the [openshell.gateway.oidc] table contains no admin_role or user_role key.

Environment

• OpenShell: 0.0.116 (gateway image and Helm chart)
• OS: Talos Linux v1.13.7
• Runtime: Kubernetes v1.36.2
• Deployment: See https://github.com/jfroy/flatops/blob/main/kubernetes/apps/openshell/openshell/app/helmrelease.yaml

Start with values.yaml and the Helm template that conditionally emits admin_role and user_role, then inspect OidcConfig and its default role behavior. Render or install the chart with both role values empty and inspect the generated ConfigMap. Done means the documentation matches the behavior and the chart provides a verified authentication-only deployment method.