feat: replace tenant OIDC page with Enterprise SSO connector management

- Add LogtoManagementClient methods for SSO connector CRUD + org JIT
- Add TenantSsoService with tenant isolation (validates connector-org link)
- Add TenantSsoController at /api/tenant/sso with test endpoint
- Create SsoPage with provider selection, dynamic config form, test button
- Remove old OIDC config endpoints from tenant portal (server OIDC is
  now platform-managed, set during provisioning)
- Sidebar: OIDC -> SSO with Shield icon

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/components/Layout.tsx

@@ -4,7 +4,7 @@ import {
   Sidebar,
   TopBar,
 } from '@cameleer/design-system';
-import { LayoutDashboard, ShieldCheck, Server, Users, Settings, KeyRound, Building, Fingerprint, ScrollText } from 'lucide-react';
+import { LayoutDashboard, ShieldCheck, Server, Users, Settings, Shield, Building, Fingerprint, ScrollText } from 'lucide-react';
 import { useAuth } from '../auth/useAuth';
 import { useScopes } from '../auth/useScopes';
 import { useOrgStore } from '../auth/useOrganization';
@@ -117,11 +117,11 @@ export function Layout() {
           </Sidebar.Section>
 
           <Sidebar.Section
-            icon={<KeyRound size={16} />}
-            label="OIDC"
+            icon={<Shield size={16} />}
+            label="SSO"
             open={false}
-            active={isActive(location, '/tenant/oidc')}
-            onToggle={() => navigate('/tenant/oidc')}
+            active={isActive(location, '/tenant/sso')}
+            onToggle={() => navigate('/tenant/sso')}
           >
             {null}
           </Sidebar.Section>