feat: OIDC SSO provider support (Keycloak, Azure AD, custom)

- Refactored azure_sso.rs to sso.rs with generic OIDC provider support
- Added OIDC discovery URL lookup with 1hr TTL caching
- Added PKCE for all providers, client_secret optional for public clients
- Added /api/v1/auth/sso/login and /api/v1/auth/sso/callback routes
- Added /api/v1/auth/azure/* backward-compatible routes
- Added POST /settings/sso/discover and POST /settings/sso/test endpoints
- Frontend: Provider dropdown (Keycloak/Azure AD/Custom OIDC)
- Frontend: Auto-fill discovery URL for Keycloak
- Frontend: Discover Endpoints and Test Connection buttons
- Frontend: Dynamic SSO button based on provider display name
- Made migration 014 idempotent with DO blocks and IF NOT EXISTS
- Fixed debian/install to use /usr/local/bin/ for binaries
- Fixed frontend file path in .deb package
- Reset admin password on dev server
- Fixed database permissions for oidc_config table

Cargo.lock

@@ -2381,7 +2381,7 @@ dependencies = [
 
 [[package]]
 name = "pm-agent-client"
-version = "0.1.3"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "chrono",
@@ -2398,7 +2398,7 @@ dependencies = [
 
 [[package]]
 name = "pm-auth"
-version = "0.1.3"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "argon2",
@@ -2425,7 +2425,7 @@ dependencies = [
 
 [[package]]
 name = "pm-ca"
-version = "0.1.3"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "chrono",
@@ -2448,7 +2448,7 @@ dependencies = [
 
 [[package]]
 name = "pm-core"
-version = "0.1.3"
+version = "0.1.5"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -2472,7 +2472,7 @@ dependencies = [
 
 [[package]]
 name = "pm-reports"
-version = "0.1.3"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "chrono",
@@ -2492,7 +2492,7 @@ dependencies = [
 
 [[package]]
 name = "pm-web"
-version = "0.1.3"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "axum",
@@ -2529,7 +2529,7 @@ dependencies = [
 
 [[package]]
 name = "pm-worker"
-version = "0.1.3"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "chrono",