feat: replace tenant OIDC page with Enterprise SSO connector management

- Add LogtoManagementClient methods for SSO connector CRUD + org JIT
- Add TenantSsoService with tenant isolation (validates connector-org link)
- Add TenantSsoController at /api/tenant/sso with test endpoint
- Create SsoPage with provider selection, dynamic config form, test button
- Remove old OIDC config endpoints from tenant portal (server OIDC is
  now platform-managed, set during provisioning)
- Sidebar: OIDC -> SSO with Shield icon

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/types/api.ts

@@ -94,6 +94,31 @@ export interface TenantSettings {
   createdAt: string;
 }
 
+// SSO connector types
+export interface SsoConnector {
+  id: string;
+  providerName: string;
+  connectorName: string;
+  config: Record<string, unknown>;
+  domains: string[];
+  branding?: { displayName?: string; logo?: string };
+  syncProfile: boolean;
+  createdAt: string;
+}
+
+export interface CreateSsoConnectorRequest {
+  providerName: string;
+  connectorName: string;
+  config: Record<string, unknown>;
+  domains: string[];
+}
+
+export interface SsoTestResult {
+  status: string;
+  providerName: string;
+  connectorName: string;
+}
+
 // Audit log types
 export interface AuditLogEntry {
   id: string;