- add admin-configurable OIDC user provisioning settings for automatic account creation and default group assignment - move the Users page create action into the standard page header and add the Notifications page subtitle styling cleanup - keep first real OIDC sign-in on system-admin while allowing later auto-provisioning to be disabled or redirected to a chosen default group