Docs say auth.groups restricts access, but the operator doesn't enforce it #36

The docs present auth.groups as access control:

• docs/site/src/content/docs/nebariapp-crd-reference.md:119: "When specified, only users in these groups are authorized."
• README.md:227 ("Restrict to specific groups") and the section at README.md:792.
• examples/vanilla-yaml/README.md:101 and examples/kustomize-nginx/README.md:74 ("restricted to groups").

Operator v0.1.1 uses groups only to fill status.serviceDiscovery.requiredGroups (internal/controller/nebariapp_controller.go:279), as part of the config hash, and to create the groups in Keycloak (internal/controller/reconcilers/auth/providers/keycloak.go:961). The SecurityPolicy it builds has OIDC and target refs only, with no authorization rules (internal/controller/reconcilers/auth/reconciler.go:524-529). Any user in the realm who can log in reaches the app.

Upstream: nebari-dev/nebari-operator#153.

Fix

Until #153 lands, the docs need to say plainly that groups is not enforced at the gateway, and drop "restricted to groups" from the kustomize production overlay. Apps that need group restrictions must check the groups claim themselves against a verified token (see #37). When the operator enforces it, restore the wording and note the minimum operator version.

Verified against this repo at 4e50cd0, nebari-operator v0.1.1 (same commit as operator main), and NIC v0.14.0.