refactor(auth): decouple sandbox node from core deployment and add dedicated provisioning script

feat(auth): bootstrap Day 1 local auth fallback, migrations, and sandbox node

chore: Day 0 interactive setup script, documentation, and clean docker-compose OIDC defaults