Add configurable allowed email domains for Google OAuth

- Add auth.allowedEmailDomains configuration
- Configure onlinesales.ai as allowed domain
- Remove signIn resolver config (moved to backend code)
- Add documentation comments

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

templates/backstage-configmap.yaml

@@ -45,15 +45,19 @@ data:
       environment: production
       session:
         secret: ${BACKEND_SECRET}
+      # Configure allowed email domains for Google OAuth
+      # Users with these email domains can sign in without User entities in catalog
+      allowedEmailDomains:
+        - onlinesales.ai
+        # Add more domains if needed:
+        # - partner-company.com
       providers:
         google:
           production:
             clientId: ${AUTH_GOOGLE_CLIENT_ID}
             clientSecret: ${AUTH_GOOGLE_CLIENT_SECRET}
-            signIn:
-              resolvers:
-              # See https://backstage.io/docs/auth/google/provider#resolvers for more resolvers
-                - resolver: emailLocalPartMatchingUserEntityName
+            # Custom domain-based resolver is configured in backend code
+            # See packages/backend/src/plugins/auth.ts
 
     integrations:
       gitea: