revert to repo-access gate (access == dataset read access)

switch to identity-only scope + username allowlist (removes org prompt)

OAuth-gated SD dashboard (no data shipped; served from private repo)

initial commit