feat: hide users with test OIDC role from public views

Add OIDC_ROLE_TEST config var (default: 'test') to exclude test users
from dashboard stats, member counts, and the Members page. Uses
server-side filtering with exclude_test query param (default: true) and
client-side defense-in-depth filter in members.js.

- Add oidc_role_test to WebSettings in config.py
- Exclude test users from operator/member count queries in dashboard.py
- Add exclude_test param to GET /api/v1/user/profiles in user_profiles.py
- Filter test users client-side in members.js via role_names.test config
- Wire oidc_role_test into app.state and frontend config in web/app.py
- Document OIDC_ROLE_TEST in AGENTS.md and .env.example

.env.example

@@ -390,6 +390,10 @@ WEB_PORT=8080
 # Default: member
 # OIDC_ROLE_MEMBER=member
 
+# IdP role name for test users (excluded from public member views and counts)
+# Default: test
+# OIDC_ROLE_TEST=test
+
 # Secret for signing session cookies (required when OIDC_ENABLED=true)
 # Generate with: openssl rand -hex 32
 # OIDC_SESSION_SECRET=