Support multiple allowed users for write access

MAPTOOL_ALLOWED_GITEA_USER now accepts a comma-separated list of
Gitea usernames instead of just one, for when more than one person
needs upload/delete/move access.

docs/architecture.adoc

@@ -260,9 +260,11 @@ username/password — there's already an account to reuse, and it keeps
 credential storage (password hash, resets, ...) out of this app
 entirely. Successfully authenticating with Gitea is not by itself
 enough to write, though — the callback also checks the returned
-`login` against `MAPTOOL_ALLOWED_GITEA_USER`, so registering (or
-already having) any other account on that Gitea instance doesn't grant
-access here.
+`login` against `MAPTOOL_ALLOWED_GITEA_USER` (a comma-separated
+allowlist, e.g. `randy,friend1,friend2`), so registering (or already
+having) any other account on that Gitea instance doesn't grant access
+here. It's a flat allowlist — everyone in it has equal write access,
+no per-user roles or permissions.
 
 Session state is a signed cookie (`Rack::Session::Cookie`, `secure`
 in production, `httponly`, `same_site: lax`) keyed off

docs/deployment.adoc

@@ -95,12 +95,17 @@ it every push would silently log everyone out every time `main`
 changes) — generate it once (`openssl rand -hex 32`) and store that
 same value as the secret from then on, don't regenerate per-deploy.
 
-Register the OAuth2 application on the Gitea side (as the
-`MAPTOOL_ALLOWED_GITEA_USER` account): *Settings → Applications →
-Manage OAuth2 Applications → Create a new OAuth2 Application*, with
-redirect URI `https://map.priesol.net/auth/callback`. That gives you
-the client id/secret to store as the two `GITEA_OAUTH_*` secrets
-above.
+Register the OAuth2 application once, under any one Gitea account
+(doesn't need to be an allowed user itself — any Gitea account can
+authenticate through it, `MAPTOOL_ALLOWED_GITEA_USER` is what actually
+decides who gets write access): *Settings → Applications → Manage
+OAuth2 Applications → Create a new OAuth2 Application*, with redirect
+URI `https://map.priesol.net/auth/callback`. That gives you the client
+id/secret to store as the two `OAUTH_CLIENT_*` secrets above.
+
+`MAPTOOL_ALLOWED_GITEA_USER` itself is a comma-separated list of Gitea
+usernames, e.g. `randy,friend1,friend2` — not their emails, the
+`login` field from Gitea's `/api/v1/user`.
 
 == CI deploy job