Block a user
Onboard repospawner UI to Authentik OIDC
Merged origin/main; akR-global-admin conflict resolved by keeping both nestings (akP-repospawner-admin and akP-vault-admin).
Allow ghcr.io/arabcoders/watchstate via artifactapi