Block guest accounts from web UI login

The web UI now validates the MCIAS token after login and rejects
accounts with the guest role before setting the session cookie.
This is defense-in-depth alongside the env:restricted MCIAS tag.

The webserver.New() constructor takes a new ValidateFunc parameter
that inspects token roles post-authentication. MCIAS login does not
return roles, so this requires an extra ValidateToken round-trip at
login time (result is cached for 30s).

Security: guest role accounts are denied web UI access

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/mcr-web/main.go

@@ -99,6 +99,14 @@ func runServer(configPath string) error {
 		return authClient.Login(username, password)
 	}
 
+	validateFn := func(token string) ([]string, error) {
+		claims, err := authClient.ValidateToken(token)
+		if err != nil {
+			return nil, err
+		}
+		return claims.Roles, nil
+	}
+
 	// Generate CSRF key.
 	csrfKey := make([]byte, 32)
 	if _, err := rand.Read(csrfKey); err != nil {
@@ -106,7 +114,7 @@ func runServer(configPath string) error {
 	}
 
 	// Create web server.
-	srv, err := webserver.New(registryClient, policyClient, auditClient, adminClient, loginFn, csrfKey)
+	srv, err := webserver.New(registryClient, policyClient, auditClient, adminClient, loginFn, validateFn, csrfKey)
 	if err != nil {
 		return fmt.Errorf("create web server: %w", err)
 	}