Add Secret-authorized tenant provisioning API - #64

External provisioning systems currently have no dedicated create-user API. This adds POST /system/api/v1/users, authorized by an externally managed Kubernetes Secret, to create an OPS tenant and its routes through the existing operator flow.

The request accepts user, password, email and optional comma-separated services (default all, meaning tenant services already enabled in the cluster). Success returns 202 Accepted with provisioning pending; existing, blocked, deleting or retained names return 409 without updating the account. No credentials are returned.

Authorization and lifecycle

• Uses the optional openserverless/openserverless-user-provisioning-token Opaque Secret and a Bearer token, separate from tenant AUTH and SSO credentials. Normal startup and other endpoints do not require the Secret.
• One background refresher per process performs Secret reads independently of HTTP traffic. Invalid bearers cannot trigger per-request Kubernetes lookups or a shared cooldown that locks out valid callers.
• Rotation and revocation work without restart, with a documented maximum two-second stale-credential window measured from the start of each Secret read. Missing, invalid, unreadable or expired state fails closed. Cold start returns 503 with Retry-After: 1; already authorized requests may complete.
• Rejects deleted subject tombstones and retained OpenWhisk entity/activation namespaces, preventing new credentials from inheriting an old tenant's data.
• Creates WhiskUsers with POST, preserves conflicts, validates input before mutation, and reports partial route creation without deleting a tenant already being reconciled.

Includes scoped optional RBAC, nginx/Traefik route construction, OpenAPI documentation and an operator guide in docs/USER_PROVISIONING.md. Existing login/SSO handlers, builder behavior, Dockerfile and release workflows are unchanged. The PR is based on current Apache 0.9.0 (bab3543); it excludes personal Advanced upgrades and image publication workflows.

Validation

• Full unittest discovery on this exact 0.9.0 source: 84 tests passed, using the candidate image's installed dependency environment, offline with the source mounted read-only. Includes existing legacy/SSO/builder tests and provisioning validation, conflicts, concurrency, secret lifecycle, namespace retention and redaction tests.
• The shared provisioning implementation was tested in the K3s baseline lab: tenant creation/readiness/login, service CRUD, routes, duplicate protection, rotation and revocation. During bounded mixed traffic, 1,200 invalid bearer requests returned 401 while valid requests continued to complete; three new tenants were created. Alpha/Beta passed 15 application, 84 Redis/Lua and 24 Streamer checks without application source changes.
• Targeted Daybreak review of the shared authorization diff reported no new findings. This is a scoped review, not a repository-wide security certification.
• git diff --check passed. Live MinIO, live nginx and multi-replica saturation were not tested; route contracts are covered by unit tests.

The published personal candidate includes additional Advanced code and is not an image of this isolated Apache PR. No cluster deployment or Apache image publication is performed by this PR.