feat(openhands): add userProvisioning.enabled feature switch (#728)

* feat(openhands): add userProvisioning.enabled feature switch

Wires the admin POST /api/organizations/provision-user endpoint
behind a per-environment Helm switch:

- charts/openhands/values.yaml: new userProvisioning.enabled value,
  defaulting to false so staging and production inherit the off state
  unless an env-specific override flips it on.
- charts/openhands/templates/_env.yaml: when userProvisioning.enabled
  is true, project USER_PROVISIONING_ENABLED=true into the deployment
  env, which the enterprise app server reads to decide whether to
  register the user-provisioning router. Sits next to the existing
  ADD_DEBUGGING_ROUTES gate for symmetry.

Backend change that consumes the switch lands in
OpenHands/OpenHands#14864. The deploy repo override that sets it true
for per-branch feature deployments lands in a companion deploy PR.

Co-authored-by: openhands <openhands@all-hands.dev>

* Update chart version

* Update comments

---------

Co-authored-by: openhands <openhands@all-hands.dev>

Author: chuckbutkus

charts/openhands/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 description: OpenHands is an AI-driven autonomous software engineer
 name: openhands
 appVersion: cloud-1.38.0
-version: 0.7.59
+version: 0.7.60
 maintainers:
   - name: rbren
   - name: xingyao

charts/openhands/templates/_env.yaml

@@ -341,6 +341,11 @@
   value: "1"
 {{- end }}
 
+{{- if .Values.userProvisioning.enabled }}
+- name: USER_PROVISIONING_ENABLED
+  value: "true"
+{{- end }}
+
 {{- $dbSslMode := "prefer" }}
 {{- if not .Values.postgresql.enabled }}
 {{- $dbSslMode = .Values.externalDatabase.sslMode | default "prefer" }}

charts/openhands/values.yaml

@@ -36,6 +36,14 @@ datadog:
 debuggingRoutes:
   enabled: false
 
+# Admin POST /api/organizations/provision-user endpoint. When enabled,
+# the enterprise app server registers the user-provisioning router and
+# sets USER_PROVISIONING_ENABLED=true. This endpoint should only be
+# enabled for OHE deployments when the customer needs to create users
+# without any user input.
+userProvisioning:
+  enabled: false
+
 databaseMigrations:
   waitForDatabase: true
   createDatabases: false