feat(access)!: choose login or anonymous at deploy time

[binarycodes]

Whichday was login-only. WHICHDAY_ACCESS_MODE now picks one mode at deploy time.

anonymous (the new default) — no provider, nothing to configure. You type a name,
the link is the invitation, and a six-digit admin code is what gets an organizer back
in. No polls list, no invitees, no reminders, and nothing claims to know who hasn't
answered — because nothing does.

login — exactly as before. OIDC, invitees, the lot.

Notes

• The OIDC block moved into application-login.properties and has to stay there: Boot
  fetches the issuer's discovery document at startup, so anonymous mode inheriting it
  would hang on a provider it has no reason to reach.
• Access rules stay in PollService — three branches, nothing else knows there are two
  modes. Caller carries the admin code so the service stays free of session state.
• V2 adds a nullable admin_code, compared only against the poll you already hold the
  link to, so no unique index.
• Locking now goes through /poll/:id/settle and can be cancelled. It could not be undone.