CON2: recreate fork on current upstream main

[japsu]

NOTE: our main branch is con2 and the intent of con2-next is to become the next con2 branch. This pull request exists not for the purpose of merging into main but to make our diff against upstream reviewable.

Ports forward con2's custom bits onto a fresh base (upstream main, v1.9.1+212 commits, vs. con2's previous anchor at v0.67.0 from Jan 2023), replacing the pieces that no longer fit the current codebase:

• New plugins/kompassi plugin, replacing the old hand-rolled OAuth2 provider (server/routes/auth/providers/kompassi.ts, which used an auth-provider mechanism that no longer exists upstream). Talks to Kompassi's now-standard OIDC provider instead of the legacy /oauth2 + /api/v2/people/me endpoints, keeps the same hard sign-in gate and admin-group role sync (KOMPASSI_ACCESS_GROUPS / KOMPASSI_ADMIN_GROUPS), and syncs groups via Outline's core (currently unused by any bundled plugin) group-sync framework instead of the old plugin's manual, not-team-scoped GroupUser sync. Deliberately keeps authenticationProvider.name = "kompassi" (not "oidc") and forces emailVerified = true so existing user accounts and the existing AuthenticationProvider row on each site reattach instead of being orphaned; see plugins/kompassi/server/auth/ kompassiRouter.ts for the reasoning.
• New plugins/local, a straight port of the old insecure dev-only sign-in shortcut onto the current plugin/accountProvisioner APIs.
• server/models/Attachment.ts: reapply the MinIO isPrivate override.
• Dockerfile.con2 rewritten as a thin wrapper around upstream's own now-current Dockerfile/Dockerfile.base (Node 26, previously we carried a frozen Node 16 fork of both) instead of forking them; skaffold.in.yaml gains a third build stage to fit.
• kubernetes/, .github/workflows/con2.yaml ported over unchanged, since the env var surface (KOMPASSI_, POSTGRES_, etc.) didn't change.

Verified: yarn install, yarn tsc (0 errors), yarn oxlint --type-aware on the new/changed files, yarn build:server, and yarn vite:build all pass on this branch. Not yet verified: an actual login against Kompassi (needs a registered OIDC Application, none exist yet for Outline on Kompassi) or a real Docker/K8s deploy.