…CFILES_DIRS

The commented deployment example set STATIC_ROOT = os.getcwd()/'static', which
is the same path as STATICFILES_DIRS (web/static) in settings.py. Uncommenting
it for an NGINX deploy (DEBUG=False) makes the collectstatic destination equal a
source dir and trips Django's staticfiles.E002, breaking every system check
(runserver/collectstatic/etc.). Point the example at a separate dir
(static_collected) and document why source must not equal destination.

…ogin loop)

The guac-web HTTP views gated on stock login_required -> auth.get_user(), which
load_backend()s the exact auth backend the session was created with. guac-web
(web.guac_settings) deliberately does not install the allauth app stack, so an
OIDC/allauth session's backend is not in its AUTHENTICATION_BACKENDS and
get_user() returns AnonymousUser -- so every interactive live-VM console request
for an OIDC user (processing jobs only; completed jobs never open the console)
was redirected to the login page, even though the browser was authenticated on
the main web. Only local ModelBackend admins worked, masking it.

The websocket path already solved this with the backend-agnostic
resolve_session_user (guac/channels_auth.py); apply the same to the HTTP views
via a guac_login_required decorator (user id + session auth-hash check, no
load_backend). Redirect-to-login for genuinely anonymous sessions is unchanged.
Adds regression tests.

fix(guac): OIDC users bounced to login on the interactive console + staticfiles.E002 footguns