Empty server.oidc.adminRole/userRole silently enables RBAC instead of authentication-only mode

User Story

As a cluster operator, I want to deploy OpenShell gateway in auth-only mode.

Problem Statement

values.yaml documents authentication-only mode thusly:

    # -- Role name for admin access. Leave empty (with userRole also empty) for
    # authentication-only mode. Both must be set or both empty.
    adminRole: ""
    # -- Role name for standard user access.
    userRole: ""

But the chart guards both keys on truthiness:

{{- if .Values.server.oidc.adminRole }}
admin_role    = {{ .Values.server.oidc.adminRole | quote }}
{{- end }}

so empty strings are omitted from the rendered TOML rather than emitted as "". OidcConfig then applies #[serde(default = "default_admin_role")], restoring openshell-admin / openshell-user. The gateway starts in RBAC mode with the stock role names.

Impact / Why This Matters

The chart provides no way to deploy in auth-only mode and its documentation is misleading.

Acceptance Criteria

• Documentation is changed to reflect actual chart behavior.
• Method to deploy in auth-only mode is added to the chart.

Reproduction Steps

1. Install the chart with server.oidc.issuer set and server.oidc.adminRole / server.oidc.userRole left at their "" defaults.
2. kubectl -n openshell get cm openshell-config -o yaml — the [openshell.gateway.oidc] table contains no admin_role or user_role key.

Environment

• OpenShell: 0.0.116 (gateway image and Helm chart)
• OS: Talos Linux v1.13.7
• Runtime: Kubernetes v1.36.2
• Deployment: See https://github.com/jfroy/flatops/blob/main/kubernetes/apps/openshell/openshell/app/helmrelease.yaml

Beginne mit values.yaml und dem Helm-Template, das admin_role und user_role bedingt ausgibt, und untersuche anschließend OidcConfig und dessen Standardverhalten für Rollen. Rendere oder installiere das Chart mit leeren Werten für beide Rollen und untersuche die generierte ConfigMap. Erledigt ist die Aufgabe, wenn die Dokumentation dem Verhalten entspricht und das Chart eine verifizierte Bereitstellungsmethode nur zur Authentifizierung bietet.