fix(helm): support OIDC authentication-only mode

[guanchzhou]

Summary

Make the chart's documented OIDC authentication-only mode effective by rendering explicit empty role values, while rejecting partial role pairs before deployment.

Related Issue

Fixes #3045

Related Work

#1871 includes this Helm behavior within a broader authentication-posture change and is currently blocked by merge conflicts. This PR stays narrowly scoped to the reported chart bug.

Changes

• Render admin_role and user_role whenever OIDC is enabled so empty values override gateway defaults
• Reject partial admin/user role configuration when OIDC is enabled
• Document the distinction between omitted and explicitly empty role values
• Add Helm unit tests for authentication-only, RBAC, and invalid partial configurations

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (not applicable)
• helm unittest deploy/helm/openshell (123 tests)
• helm unittest deploy/helm/openshell-workspace (4 tests)
• Helm lint passes for defaults and all CI values variants
• Generated Helm README check passes

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[guanchzhou]

I have read the DCO document and I hereby sign the DCO.

[guanchzhou]

recheck

[guanchzhou]

Closing in favor of #1871, which already covers this chart behavior and gates authentication-only mode behind an explicit server.auth.allowOidcAuthOnly opt-in.

This PR rendered empty roles unconditionally, so authentication-only mode would activate silently whenever both roles were left empty. That is the posture #1871 deliberately rejects, and it also carries the matching server-side validation that this change does not touch. Landing this first would work against that design.