feat: OIDC SSO provider support (Keycloak, Azure AD, custom)

- Refactored azure_sso.rs to sso.rs with generic OIDC provider support
- Added OIDC discovery URL lookup with 1hr TTL caching
- Added PKCE for all providers, client_secret optional for public clients
- Added /api/v1/auth/sso/login and /api/v1/auth/sso/callback routes
- Added /api/v1/auth/azure/* backward-compatible routes
- Added POST /settings/sso/discover and POST /settings/sso/test endpoints
- Frontend: Provider dropdown (Keycloak/Azure AD/Custom OIDC)
- Frontend: Auto-fill discovery URL for Keycloak
- Frontend: Discover Endpoints and Test Connection buttons
- Frontend: Dynamic SSO button based on provider display name
- Made migration 014 idempotent with DO blocks and IF NOT EXISTS
- Fixed debian/install to use /usr/local/bin/ for binaries
- Fixed frontend file path in .deb package
- Reset admin password on dev server
- Fixed database permissions for oidc_config table

crates/pm-web/src/routes/mod.rs

@@ -1,6 +1,5 @@
 //! Route modules for the pm-web API.
 pub mod auth;
-pub mod azure_sso;
 pub mod ca;
 pub mod discovery;
 pub mod groups;
@@ -9,6 +8,7 @@ pub mod hosts;
 pub mod jobs;
 pub mod maintenance_windows;
 pub mod settings;
+pub mod sso;
 pub mod status;
 pub mod users;
 pub mod ws;