Add EUROfusion access onboarding docs

[krystophny]

Problem

Issue #18 tracks adding ITPcp members (Chris, Winny, Sergei, Max) to the
EUROfusion DevOps/Gateway infrastructure. There was nothing in the
repository documenting how EUROfusion access is obtained or verified, so
new members had no idea how to request an account and the checklist was
unverifiable from the repo.

Change

• Add docs/eurofusion-access.md documenting the EUROfusion DevOps /
  Gateway access request route (via the group lead, not self-service),
  SSH key reuse, and the concrete commands each member should run to
  verify their account and — more importantly — their ITPcp group/project
  membership on the DevOps GitLab.
• Link to it from the README ## Getting Started section, right after the
  existing SSH-key setup paragraph.

The exact Gateway/DevOps GitLab hosts intentionally come from the
account-grant mail rather than being guessed, so the doc cannot point
members at a wrong host; it instructs them to use the granted host.

Tests

Documentation-only change; no build or pytest surface is affected.
pytest tests/ is untouched.

Closes #18

[krystophny]

Review verdict: Request changes

Summary: Documentation-only change, but it does not satisfy the issue’s acceptance criteria because the core access instructions still contain unresolved host placeholders.

Findings:

1. [major] docs/eurofusion-access.md:27,47,51 — The Gateway and DevOps GitLab hosts remain <gateway-host> and <eufus-gitlab-host>, so new members cannot follow or verify the documented setup. Replace them with the exact verified hosts from the account-grant documentation, or provide an authoritative route to obtain them.

Verdict: Request changes — the primary onboarding workflow is incomplete; no CI checks are configured for this commit.

[krystophny]

Review verdict: Request changes

Summary: The documentation is clear and the Gateway details match the referenced issue and official CINECA guidance. CI was still running; no code or test changes are affected.

Findings:

1. [major] docs/eurofusion-access.md:33 — The document names the DevOps GitLab SSH host but provides no web URL or project/group path for SSO. New members therefore cannot follow the required membership-verification step. Add the exact web URL and relevant ITPcp group/project.

Verdict: Request changes — the onboarding flow is incomplete without the DevOps GitLab web destination.

[krystophny]

Review verdict: Request changes

Summary: Documentation-only change; the README link is appropriate, but the onboarding instructions contain an invalid UserDB hostname and omit the mandatory EFGW SSH-certificate/2FA setup. CI is still pending.

Findings:

1. [major] docs/eurofusion-access.md:25-46 — userdb.cineca.it does not resolve; the linked CINECA documentation uses userdb.hpc.cineca.it. Additionally, current EFGW access requires a time-limited SSH certificate and 2FA, so reusing id_rsa alone will not make the Gateway command work. Correct the portal URL and document the step ssh login ... --provisioner efgw setup, distinguishing Gateway authentication from the GitLab SSH key.

Verdict: Request changes — new users cannot reliably follow the documented access procedure.

[krystophny]

Review verdict: Comment

Summary: Documentation-only PR; the Gateway details match current CINECA documentation, but the access-status wording is inconsistent with issue #18, and CI is still running at NEO-2.

Findings:

1. [minor] docs/eurofusion-access.md:19-21 — Says Chris, Winny, Sergei, and Max are current members “with access,” while issue #18 marks only Chris complete and explicitly says the others are unknown/untested. This can falsely indicate that access is already verified; describe them only as tracked members or update the issue with evidence.
2. [minor] docs/eurofusion-access.md:48-53 — Recommends reusing the blank-passphrase id_rsa key. This inherits and reinforces insecure guidance from README; recommend a protected, dedicated key instead, or clearly document the security trade-off.

Verdict: Comment — the main documentation issues should be corrected, and CI completion is not yet available.