Adds omniauth_openid_connect with Clerk as the IdP, gated on
CLERK_DISCOVERY_URL / CLERK_CLIENT_ID / CLERK_CLIENT_SECRET. When unset,
behaves identically to upstream. Password login + 2FA preserved as
fallback.
Access gate (v1): email-domain allowlist via CLERK_ALLOWED_EMAIL_DOMAINS.
First-time login auto-creates the User on the singleton Account with
role=admin. Drops into the empty _omniauthable.html.erb partial DocuSeal
already reserved in the login view.
Omar