Draft: feat(workspace): introduce Murena Workspace backend descriptor

Closes #113

What is implemented

MurenaWorkspaceDescriptor

Central data class deriving all service endpoints from a workspaceDomain:

• baseWebUrl, dashboardUrl, davBaseUrl
• mailAutoconfigUrl (subdomain autoconfig.) + mailAutoconfigWellKnownUrl (RFC 5785)
• oidcIssuer (null until discovery) + oidcDiscoveryUrl (derived from issuer)

MurenaOidcDiscovery

Discovers the OIDC issuer by following the unauthenticated redirect from /apps/oidc_login/oidc:

GET /apps/oidc_login/oidc → 302 https://accounts.murena.io/auth/realms/murena/protocol/openid-connect/auth?...

The Keycloak issuer is extracted by stripping the /protocol/openid-connect suffix. Static derivation (accounts.{domain}) is insufficient since the realm name cannot be inferred from the domain alone.

discover() returns a sealed result type:

• Result.Discovered — issuer resolved, descriptor enriched
• Result.NotConfigured — OIDC absent or not configured on this server
• Result.Failed — transient error (network, server unavailable)

MurenaServerConfig.getDescriptor()

Entry point to obtain the descriptor for the active environment (staging or production).