feat(staging): scope staging sign-in to the team

k8s/helm/commonly/templates/core/backend-deployment.yaml

@@ -119,6 +119,20 @@ spec:
         - name: REGISTRATION_INVITE_ONLY
           value: {{ .Values.backend.env.registrationInviteOnly | quote }}
         {{- end }}
+        {{- if .Values.backend.env.authAllowedDomains }}
+        # Instance access allowlist. Any value here flips
+        # isInstanceAccessRestricted() true and gates BOTH register and login.
+        # Unset (prod/values-dev) = public. Staging scopes sign-in to the team.
+        - name: AUTH_ALLOWED_DOMAINS
+          value: {{ .Values.backend.env.authAllowedDomains | quote }}
+        {{- end }}
+        {{- if .Values.backend.env.authAllowedEmailsFromSecret }}
+        - name: AUTH_ALLOWED_EMAILS
+          valueFrom:
+            secretKeyRef:
+              name: api-keys
+              key: auth-allowed-emails
+        {{- end }}
 
         # Database Connections
         - name: MONGO_URI

k8s/helm/commonly/templates/ops/ops-runner-deployment.yaml

@@ -86,6 +86,20 @@ spec:
         - name: REGISTRATION_INVITE_ONLY
           value: {{ .Values.backend.env.registrationInviteOnly | quote }}
         {{- end }}
+        {{- if .Values.backend.env.authAllowedDomains }}
+        # Mirrors backend (ops-runner env drift guard). The allowlist is read by
+        # the serving API, not the sleeping ops-runner, but the two env blocks
+        # must stay tuple-identical — see opsRunnerEnvMirror.test.js.
+        - name: AUTH_ALLOWED_DOMAINS
+          value: {{ .Values.backend.env.authAllowedDomains | quote }}
+        {{- end }}
+        {{- if .Values.backend.env.authAllowedEmailsFromSecret }}
+        - name: AUTH_ALLOWED_EMAILS
+          valueFrom:
+            secretKeyRef:
+              name: api-keys
+              key: auth-allowed-emails
+        {{- end }}
 
         # Database Connections
         - name: MONGO_URI

k8s/helm/commonly/templates/secrets/api-keys.yaml

@@ -318,4 +318,14 @@ spec:
   - secretKey: session-secret
     remoteRef:
       key: {{ $keyPrefix }}session-secret
+
+  {{- if .Values.backend.env.authAllowedEmailsFromSecret }}
+  # Team-only sign-in allowlist. The remote key must exist in Secret
+  # Manager before this flips — a missing remoteRef prevents ESO from syncing
+  # the whole api-keys secret (same rule as the Slack block above). Only
+  # staging sets the flag; prod leaves it unset and stays public.
+  - secretKey: auth-allowed-emails
+    remoteRef:
+      key: {{ $keyPrefix }}auth-allowed-emails
+  {{- end }}
 {{- end }}

k8s/helm/commonly/values-staging.yaml

@@ -176,6 +176,15 @@ backend:
     agentComputerSteelApiUrlTemplate: "http://steel-{userId}.commonly-staging.svc.cluster.local:3000"
     agentComputerSteelCdpUrlTemplate: "http://steel-{userId}.commonly-staging.svc.cluster.local:9223"
     agentComputerAllowedHosts: "linkedin.com,www.linkedin.com"
+    # Team-only staging sign-in. Any value flips isInstanceAccessRestricted()
+    # true and gates BOTH register and login; prod (values-dev) sets neither and
+    # stays public. Domains cover the seed accounts (@seed.staging.commonly.me) and
+    # both CI smoke accounts (@ops.commonly.invalid) so staging-smoke stays green.
+    # Individual team emails are PII and live in the GCP SM secret
+    # commonly-staging-auth-allowed-emails (NOT in this repo), surfaced via the
+    # api-keys ExternalSecret → AUTH_ALLOWED_EMAILS when the flag below is true.
+    authAllowedDomains: "seed.staging.commonly.me,ops.commonly.invalid"
+    authAllowedEmailsFromSecret: true
     # Smaller Postgres pool for staging's Aiven db (fewer connections than prod).
     pgPoolMax: 5
     # Non-secret db name; host/user/password come from the private values +