Epic: v0.23 roles, permissions and hooks #388

Goal

Apps can authorize on what Seamless Auth issues, and extend it without forking: permissions and organization roles in the token, a guard for them in every adapter, custom claims, signed webhooks, login hooks, and audit streaming to a SIEM.

v0.23 also finishes v0.21 before new features land. The API version v0.22.0 went to the OpenID Provider session binding change, so this roadmap release is named v0.23.

Order

1. Security review follow-ups (Epic: v0.21 security review follow-ups #558). Fixes to code that is already shipped, across the API, the provider edge and every adapter. These come first.
2. Finish v0.21: native and desktop apps on the OpenID Provider (Epic: native and desktop apps on the OpenID Provider #551, including the admin API ADR docs(adr): admin API access for native clients signed in through the OpenID Provider #544 and CLI sign-in feat: sign in through the OpenID Provider with loopback and device flows seamless-cli#316), the open provider bugs, OpenID certification (chore(oidc): apply for the OpenID Foundation open source fee waiver and certify #412), the provider guides (docs: guides for Grafana, Auth.js, Spring Security and a reverse proxy with the OpenID Provider seamless-auth-docs#114) and the live Entra ID check (test(migrate): verify migrate entra-id against a live Entra ID tenant seamless-cli#302).
3. Permissions and organization roles: feat: permissions mapped to roles #415, feat: organization-scoped roles and permissions in the access token #416, then schemas, guards in every adapter, console, client SDK and provider claims.
4. Extensibility: custom claims (feat: custom claims #417), webhooks (feat: signed, retried webhooks #418), login hooks (feat: pre-token and post-login hooks as HTTP callouts #419), SIEM streaming (feat: stream audit events to a SIEM over OTLP and syslog #420), with their schemas, console pages, CLI and Node verification helper.
5. Docs, templates and release (chore: ship v0.23 (publish order, compatibility matrix, release notes, announcement) #561).

Done when

Every sub-issue is closed or moved with a reason, each feature has a published guide a coding agent can follow, the starter templates show a permission check, and the release is announced.

Children are linked as sub-issues. #551 and #558 are epics with their own sub-issues.