demo: configure external providers from one YAML profile

[proddata]

Requirement

Let an operator test a strict-JWT external provider by editing one ignored YAML file, then running the external Compose stack and its bundled psql client. This follows merged PR #8.

Changes

• Add demo/provider.example.yml and select an ignored copy with OAUTH_PROFILE (default demo/local/provider.yml).
• Render PostgreSQL configuration, HBA, identity map, first-initialization role SQL, and a matching libpq service file from the same validated profile.
• Accept exact HTTPS issuer, audience, one required database scope, public device-flow client ID, stable identity claim/value, and optional inline CA certificate.
• Pin PyYAML in the demo image and add deterministic profile tests plus a CI image-build and Compose startup job.
• Replace the four-file external-provider instructions with a one-file tutorial and migration notes.

Trust boundary and failure behavior

The profile is a local administrator input; its fields are bounded and constrained before they reach PostgreSQL or libpq configuration. Unknown or duplicate keys, aliases, malformed values, and invalid CA input stop startup with stable diagnostic codes. The generated HBA restricts TLS OAuth access to demo as app_reader; PostgreSQL still applies exact usermap authorization after strict access-token validation. This does not add provider compatibility exceptions or accept opaque tokens.

Compatibility and operations

OAUTH_CONFIG_DIR and the former four copied files no longer configure compose.external.yml. Copy demo/provider.example.yml to ignored demo/local/provider.yml, edit it, then run docker compose -f compose.external.yml up --build -d. Set OAUTH_PROFILE for another file, and use the same value for the bundled psql command. Recreate the PostgreSQL container after edits. Existing database volumes keep their initialized role; docker compose -f compose.external.yml down --volumes removes disposable data and certificates. Reverting this commit restores the four-file setup.

Verification

• Local profile/demo tests: 23 passed.
• Pinned image profile tests: 21 passed before the final audience-rejection case; that final case passed locally and will run in CI.
• make verify in the PostgreSQL 18 image: passed.
• make integrationcheck in the PostgreSQL 18 image: 28 passed, 2 skipped.
• Valid external Compose stack reached healthy status; bundled psql --version entrypoint succeeded. A stack with invalid scope exited before PostgreSQL startup and logged only profile_error: profile_scope.
• Compose validation, source-tree hygiene, and diff checks passed on the rebased follow-up branch.

A live external-provider device authorization and successful login remain provider-specific manual checks. This example is for local evaluation.