[Feature Request] Dynamically grant Superuser/Staff status to OIDC/SSO users based on group claims

Description Use Case / Problem Description Currently, when setting up OpenID Connect (OIDC) or SSO authentication in Paperless-ngx via django-allauth, automatically provisioned users are created as standard, unprivileged accounts. In declarative, containerized, or GitOps environments (such as Kubernetes, automated Docker Compose deployments or sophisticated private users), this creates a bootstrapping challenge: 1. Administrators must either maintain a static local superuser using plaintext environment variables PAPERLESS_ADMIN_USER and PAPERLESS_ADMIN_PASSWORD), which exposes credentials in docker inspect or process lists. 2. Or they must manually run createsuperuser inside the container shell, which prevents fully automated deployments. 3. Once the OIDC user logs in for the first time, a local administrator must manually elevate their account to superuser or staff status in the UI or database. While Paperless-ngx supports syncing user groups from OIDC claims via SO…