Initial commit: one_os_compositor Odoo 20 addon — core OWL library + backend models + JWT auth

Includes:
- compositor.app, compositor.session, compositor.session.app, compositor.audit.log models
- /web/compositor/{token,apps,launch,audit} HTTP controllers with JWT (HS256)
- CompositorService OWL service (reusable via useService('compositor'))
- CompositorCanvas OWL component (reusable canvas wrapper)
- Security: compositor_group_user, compositor_group_manager groups + ir.access.csv rules
- 5 demo apps pre-loaded (gnome-calculator, xterm, gtk4-demo, glxgears, featherpad)
- Audit log capturing JWT issuance + app launch events
- Stub mode: launching apps returns a stub SurfaceHandle when proxy isn't connected
- Tested against Odoo 20 + PostgreSQL 17

Author: 1bspace.com
Parent company: 1B Global
License: Proprietary (1B Space internal use)

demo/compositor_app_demo.xml

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <data noupdate="1">
+        <!-- Demo: assign all apps to "Internal Users" group so any logged-in user can launch them -->
+        <record id="compositor_app_xterm" model="compositor.app">
+            <field name="allowed_group_ids" eval="[(4, ref('base.group_user'))]"/>
+        </record>
+        <record id="compositor_app_gnome_calculator" model="compositor.app">
+            <field name="allowed_group_ids" eval="[(4, ref('base.group_user'))]"/>
+        </record>
+        <record id="compositor_app_gtk4_demo" model="compositor.app">
+            <field name="allowed_group_ids" eval="[(4, ref('base.group_user'))]"/>
+        </record>
+        <record id="compositor_app_glxgears" model="compositor.app">
+            <field name="allowed_group_ids" eval="[(4, ref('base.group_user'))]"/>
+        </record>
+        <record id="compositor_app_featherpad" model="compositor.app">
+            <field name="allowed_group_ids" eval="[(4, ref('base.group_user'))]"/>
+        </record>
+    </data>
+</odoo>