pub const OIDC_GROUP_ROLE_SYNC_STRICT: Config<bool>;
Whether to reject login when group sync fails (strict/fail-closed mode). When false (default), sync failures are logged but login proceeds (fail-open).