Add explict allow deny commands.

commands

@@ -6,7 +6,11 @@ case "$1" in
   help | google-auth:help)
     help_content() {
       cat <<help_content
-    google-auth:configure [options], Configure the shared Google OAuth service (run once)
+    google-auth:configure [options], Set Google credentials and who may sign in (re-run any time to change)
+    google-auth:allow [<domain|address>...], Let a domain or address sign in (no arguments lists the allow list)
+    google-auth:unallow <domain|address...>, Remove a domain or address from the allow list
+    google-auth:deny [<address>...], Block an address even if the allow list covers it (no arguments lists the deny list)
+    google-auth:undeny <address...>, Remove an address from the deny list
     google-auth:enable <app>, Require Google sign-in for all requests to <app>
     google-auth:disable <app>, Remove Google sign-in from <app>
     google-auth:exclude <app> <pattern...>, Exempt path prefixes (/path) or regexes (re:^/x) from sign-in
@@ -26,6 +30,27 @@ help_content
       echo ''
       echo 'Commands:'
       help_content | sort | column -c2 -t -s,
+      echo ''
+      echo 'google-auth:configure options (all persisted; re-run to change any of them):'
+      echo ''
+      echo '    --client-id <id>              Google OAuth client id'
+      echo '    --client-secret <secret>      Google OAuth client secret'
+      echo '    --auth-host <host>            the one host registered as a redirect URI with Google'
+      echo '    --allow-domain <domain>       allow any verified account at <domain> (repeatable)'
+      echo '    --allow-email <address>       allow one specific address (repeatable)'
+      echo '    --deny-email <address>        block one address, even if a rule above allows it (repeatable)'
+      echo '    --clear-deny-emails           empty the deny list'
+      echo '    --session-ttl <duration>      how long a sign-in lasts (default 24h)'
+      echo '    --cookie-name <name>          session cookie name (default _google_auth)'
+      echo '    --port <port>                 127.0.0.1 port for the auth service (default 2999)'
+      echo '    --regenerate-cookie-secret    rotate the session key (signs everyone out)'
+      echo ''
+      echo 'The allow rules are a strict allowlist: an account that matches none of them'
+      echo 'is rejected, and at least one rule is required. The deny list wins over both.'
+      echo ''
+      echo 'These flags REPLACE the list they name, so they suit initial setup. To add or'
+      echo 'remove one person afterwards, use google-auth:allow / :unallow / :deny /'
+      echo ':undeny, which change one entry at a time and restart the service for you.'
     else
       help_content
     fi