docs: add GitLab OAuth setup and provider enrollment guide

Tested end-to-end on local Minder instance. Documents the feature flag,
server config, OAuth app setup, and enrollment steps.

Refs #6435

Author: intelligent-ears

docs/docs/run_minder_server/config_gitlab_oauth.md

@@ -0,0 +1,83 @@
+---
+title: Create a GitLab OAuth application
+sidebar_position: 75
+---
+
+## Prerequisites
+
+- [GitLab](https://gitlab.com) account
+- A [local Minder server](run_the_server) running with the `gitlab_provider`
+  feature flag enabled (see [Using feature flags](../developer_guide/feature_flags))
+
+## Steps
+
+1. Navigate to [GitLab User Settings > Applications](https://gitlab.com/-/user_settings/applications)
+
+2. Click **Add new application** and enter the following details:
+   - **Name:** `Minder` (or any name you prefer)
+   - **Redirect URI** (add both URIs, one per line):
+     ```
+     http://localhost:8080/api/v1/auth/callback/gitlab/cli
+     http://localhost:8080/api/v1/auth/callback/gitlab/web
+     ```
+   - **Confidential:** Yes (checked)
+   - **Scopes:** Check `api`, `read_user`, and `read_repository`
+
+3. Click **Save application**. Copy the **Application ID** and **Secret** — the
+   secret is only shown once.
+
+4. Add the following to your `server-config.yaml` under the `provider:` section:
+
+   ```yaml
+   provider:
+     gitlab:
+       client_id: "YOUR_APPLICATION_ID"
+       client_secret: "YOUR_SECRET"
+       redirect_uri: "http://localhost:8080/api/v1/auth/callback/gitlab"
+       webhook_secret: "a-random-secret-string"
+       scopes:
+         - "api"
+         - "read_user"
+         - "read_repository"
+   ```
+
+   The `redirect_uri` should be the base path without `/cli` or `/web` — Minder
+   appends the correct suffix automatically.
+
+5. Enable the `gitlab_provider` feature flag by creating `flags-config.yaml` in
+   the root of your Minder directory:
+
+   ```yaml
+   gitlab_provider:
+     variations:
+       enabled: true
+       disabled: false
+     defaultRule:
+       variation: enabled
+   ```
+
+6. (Re)start the Minder server:
+
+   ```bash
+   make run-docker
+   ```
+
+7. Enroll the GitLab provider using the CLI:
+
+   ```bash
+   minder provider enroll --class gitlab
+   ```
+
+   A browser window will open to GitLab's OAuth authorization page. After
+   authorizing, the browser will show **Minder enrollment complete** and the CLI
+   will print `Provider enrolled successfully`.
+
+## Known limitations
+
+- GitLab support is currently only available on self-hosted Minder instances.
+  The hosted instance at `api.custcodian.dev` does not yet support GitLab
+  enrollment.
+- Webhook-based event delivery requires an externally reachable URL. For local
+  development, tools like [ngrok](https://ngrok.com) can expose your local
+  server.
+- Token identity verification after enrollment is not yet implemented.