Empty server.oidc.adminRole/userRole silently enables RBAC instead of authentication-only mode

User Story

As a cluster operator, I want to deploy OpenShell gateway in auth-only mode.

Problem Statement

values.yaml documents authentication-only mode thusly:

    # -- Role name for admin access. Leave empty (with userRole also empty) for
    # authentication-only mode. Both must be set or both empty.
    adminRole: ""
    # -- Role name for standard user access.
    userRole: ""

But the chart guards both keys on truthiness:

{{- if .Values.server.oidc.adminRole }}
admin_role    = {{ .Values.server.oidc.adminRole | quote }}
{{- end }}

so empty strings are omitted from the rendered TOML rather than emitted as "". OidcConfig then applies #[serde(default = "default_admin_role")], restoring openshell-admin / openshell-user. The gateway starts in RBAC mode with the stock role names.

Impact / Why This Matters

The chart provides no way to deploy in auth-only mode and its documentation is misleading.

Acceptance Criteria

• Documentation is changed to reflect actual chart behavior.
• Method to deploy in auth-only mode is added to the chart.

Reproduction Steps

1. Install the chart with server.oidc.issuer set and server.oidc.adminRole / server.oidc.userRole left at their "" defaults.
2. kubectl -n openshell get cm openshell-config -o yaml — the [openshell.gateway.oidc] table contains no admin_role or user_role key.

Environment

• OpenShell: 0.0.116 (gateway image and Helm chart)
• OS: Talos Linux v1.13.7
• Runtime: Kubernetes v1.36.2
• Deployment: See https://github.com/jfroy/flatops/blob/main/kubernetes/apps/openshell/openshell/app/helmrelease.yaml

Comienza con values.yaml y la plantilla de Helm que emite condicionalmente admin_role y user_role; después, inspecciona OidcConfig y su comportamiento predeterminado para los roles. Renderiza o instala el chart con los valores de ambos roles vacíos e inspecciona el ConfigMap generado. Se considera terminado cuando la documentación coincide con el comportamiento y el chart proporciona un método de despliegue verificado solo para autenticación.