clerk_email_allowed? failed OPEN on an empty CLERK_ALLOWED_EMAIL_DOMAINS
(empty env = anyone could sign in), and both SSO entrypoints
(from_clerk_oidc and the apex-cookie ClerkDeviseBridge) auto-provisioned
every first-time user as ADMIN_ROLE.
- Fail closed: an unset/empty allowlist now matches no one.
- New CLERK_ADMIN_EMAIL_DOMAINS allowlist gates admin provisioning; SSO
never silently mints an admin.
- Single chokepoint User.provision_clerk_admin used by both SSO paths.
- Add RSpec coverage (none existed).