fix(docs): match Helm values, backup Secret namespace and OIDC role mapping to the code

src/content/docs/backup-restore-crds.mdx

@@ -106,14 +106,15 @@ Uses the cluster's CSI storage provider to create native snapshots at the hyperv
 
 ## Repository credentials and references
 
-Restic-snapshot backups require a Kubernetes Secret in the operator namespace (`gameplane-system` by default) containing the repository URL and credentials.
+Restic-snapshot backups require a Kubernetes Secret containing the repository URL and credentials, in the same namespace as the Backup or BackupSchedule that references it (`gameplane-games` by default). The operator looks the Secret up in the Backup's own namespace and fails the Backup if it isn't there.
 
 ```yaml
-# Secret in gameplane-system namespace
+# Secret in the Backup's namespace
 apiVersion: v1
 kind: Secret
 metadata:
   name: my-backup-repo
+  namespace: gameplane-games
   labels:
     gameplane.local/backup-destination: "true"
 type: Opaque

src/content/docs/installation.mdx

@@ -97,16 +97,26 @@ api:
 
 ### Optional: OIDC authentication at install time
 
-If you use OIDC (OpenID Connect) for single sign-on, seed the role mappings at install time:
+If you use OIDC (OpenID Connect) for single sign-on, the chart can configure the provider at install time. In v0.2.0-beta.8 the chart accepts only the connection settings; map IdP groups to roles per provider under **Admin Settings → Authentication** after install:
 
 ```yaml
+# v0.2.0-beta.8
 api:
   oidc:
     enabled: true
     issuer: "https://your-idp.example.com"
     clientID: "gameplane-app"
     clientSecretRef:
       name: "oidc-client-secret"    # k8s Secret with 'clientSecret' key
+    redirectURL: "https://gameplane.your-domain.test/auth/oidc/callback"
+```
+
+From v0.3.0 the chart can also seed the provider's display name and role mappings. Add these keys only when installing a v0.3.0 or later chart:
+
+```yaml
+# v0.3.0 and later (in addition to the keys above)
+api:
+  oidc:
     displayName: "My SSO Provider"
     groupsClaim: "groups"           # OIDC claim containing group memberships
     defaultRole: "viewer"           # Default role when group mapping doesn't match
@@ -128,16 +138,23 @@ Enable default-deny policies in the games namespace to prevent pod-to-pod and ou
 ```yaml
 networkPolicies:
   enabled: true
-  # Allow kubelet liveness/readiness probes
-  kubeletCIDRs: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16"
+  # Allow kubelet liveness/readiness probes (a list; empty falls back to
+  # RFC1918 + link-local)
+  kubeletCIDRs:
+    - 10.0.0.0/8
+    - 172.16.0.0/12
+    - 192.168.0.0/16
+    - 169.254.0.0/16
   # Allow player ingress (TCP/UDP for game traffic)
   gameIngress:
     enabled: true
     fromCIDRs: ["0.0.0.0/0"]        # Players from anywhere (restrict to your network)
   # Allow public-internet egress (downloads, mod registries)
   gameEgress:
     enabled: true
-    ports: [80, 443]
+    ports:
+      - { protocol: TCP, port: 443 }
+      - { protocol: TCP, port: 80 }
 ```
 
 ### Module sources and catalog

src/content/docs/sign-in-recovery.mdx

@@ -46,10 +46,10 @@ Local accounts use a Gameplane credential; provider buttons delegate password an
 
 **Local auth** requires the account to exist in Gameplane's local user list — created manually under **Admin Settings → Users** or automatically on first OIDC login (assigned the viewer role by default). Each local account stores an `argon2id`-hashed password; the API enforces a 12-character minimum.
 
-**OIDC** (OpenID Connect) delegates authentication to a third-party identity provider (Keycloak, Authentik, Google Workspace, Okta, etc.). The provider handles password storage and MFA; Gameplane stores only the OIDC subject ID (issuer + subject claim); group-claim role mapping is not available in beta.8 (coming in v0.3.0). Providers are configured under **Admin Settings → Authentication** and take effect on the next user login (no API restart required).
+**OIDC** (OpenID Connect) delegates authentication to a third-party identity provider (Keycloak, Authentik, Google Workspace, Okta, etc.). The provider handles password storage and MFA; Gameplane stores only the OIDC subject ID (issuer + subject claim). Each provider can map IdP groups to dashboard roles (a groups claim, per-role group lists and a default role); a user with no matching group gets the default role, `viewer` unless you change it. Seeding these mappings from Helm values arrives in v0.3.0. Providers are configured under **Admin Settings → Authentication** and take effect on the next user login (no API restart required).
 
 <DocsCallout icon="info" title="Coming in v0.3.0">
-  OIDC group-claim role mapping will allow you to derive user roles from your identity provider's group claims, enabling zero-trust RBAC on login without post-deployment configuration.
+  The Helm chart will be able to seed each provider's group-to-role mappings from values (`api.oidc.groupsClaim`, `roleMappings`, `defaultRole`), so a fresh install derives roles on first login without post-deployment configuration.
 </DocsCallout>
 
 For provider-specific setup steps, see [Users, Auth & RBAC](../users-auth-rbac/).
@@ -106,7 +106,7 @@ An administrator with the `users:manage` role can reset any local user's passwor
 
 The user's effective role in Gameplane is determined by:
 - **Local account**: the role manually assigned in **Admin Settings → Users**
-- **OIDC account**: the role is the viewer role by default (coming in v0.3.0: the role derived from the provider's group claim if group mapping is configured in **Admin Settings → Authentication**) *or* the role manually assigned in **Admin Settings → Users** as an override
+- **OIDC account**: the role derived from the provider's group claim when group mapping is configured in **Admin Settings → Authentication** (otherwise the provider's default role, `viewer` unless changed) *or* the role manually assigned in **Admin Settings → Users** as an override
 
 To test your own recovery process, log out and use a private/incognito window to attempt re-login. If you are locked out of OIDC and cannot log in via a local backup account, use one of these break-glass paths: