feat: replace tenant OIDC page with Enterprise SSO connector management

- Add LogtoManagementClient methods for SSO connector CRUD + org JIT
- Add TenantSsoService with tenant isolation (validates connector-org link)
- Add TenantSsoController at /api/tenant/sso with test endpoint
- Create SsoPage with provider selection, dynamic config form, test button
- Remove old OIDC config endpoints from tenant portal (server OIDC is
  now platform-managed, set during provisioning)
- Sidebar: OIDC -> SSO with Shield icon

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/router.tsx

@@ -14,7 +14,7 @@ import { TenantDetailPage } from './pages/vendor/TenantDetailPage';
 import { VendorAuditPage } from './pages/vendor/VendorAuditPage';
 import { TenantDashboardPage } from './pages/tenant/TenantDashboardPage';
 import { TenantLicensePage } from './pages/tenant/TenantLicensePage';
-import { OidcConfigPage } from './pages/tenant/OidcConfigPage';
+import { SsoPage } from './pages/tenant/SsoPage';
 import { TeamPage } from './pages/tenant/TeamPage';
 import { SettingsPage } from './pages/tenant/SettingsPage';
 import { TenantAuditPage } from './pages/tenant/TenantAuditPage';
@@ -77,7 +77,7 @@ export function AppRouter() {
             {/* Tenant portal */}
             <Route path="/tenant" element={<TenantDashboardPage />} />
             <Route path="/tenant/license" element={<TenantLicensePage />} />
-            <Route path="/tenant/oidc" element={<OidcConfigPage />} />
+            <Route path="/tenant/sso" element={<SsoPage />} />
             <Route path="/tenant/team" element={<TeamPage />} />
             <Route path="/tenant/audit" element={<TenantAuditPage />} />
             <Route path="/tenant/settings" element={<SettingsPage />} />