fix: code review findings — auth-settings HTTP method, authorization, redirect

- Change auth-settings endpoint from PUT to PATCH (matches partial update semantics and frontend hook)
- Add @PreAuthorize("SCOPE_tenant:manage") to updateAuthSettings endpoint
- Consolidate MFA/passkey 403 redirect handling in API client

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/main/java/net/siegeln/cameleer/saas/portal/TenantPortalController.java

@@ -5,6 +5,7 @@ import net.siegeln.cameleer.saas.certificate.TenantCaCertService;
 import net.siegeln.cameleer.saas.config.TenantContext;
 import net.siegeln.cameleer.saas.tenant.TenantService;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.web.bind.annotation.DeleteMapping;
@@ -239,7 +240,8 @@ public class TenantPortalController {
         return ResponseEntity.ok(portalService.getAuthSettings());
     }
 
-    @PutMapping("/auth-settings")
+    @PreAuthorize("hasAuthority('SCOPE_tenant:manage')")
+    @PatchMapping("/auth-settings")
     public ResponseEntity<Void> updateAuthSettings(@RequestBody Map<String, Object> updates) {
         portalService.updateTenantSettings(updates);
         return ResponseEntity.ok().build();