feat: Complete Azure SSO implementation (v0.1.3)

- Add SSO session cleanup task (10-min expiry, 60s purge interval)
- Change callback to redirect to frontend with tokens as query params
- Add sso_callback_url to SecurityConfig with serde default
- Add SsoCallbackPage.tsx for handling SSO callback redirects
- Add /auth/sso/callback public route to App.tsx
- Add Sign in with Microsoft Azure button to LoginPage
- Replace insecure decode_jwt_payload with verify_id_token
- Implement JWKS caching (1-hour TTL) and RSA signature verification
- Validate iss, aud, exp claims on id_token
- Add jsonwebtoken dependency to pm-web crate
- Update config.example.toml with sso_callback_url setting
- Add sso_callback_url to settings response (read-only from TOML)

frontend/src/App.tsx

@@ -5,6 +5,7 @@ import { darkTheme } from './theme/theme'
 import { useAuthStore } from './store/authStore'
 import AppLayout from './components/AppLayout'
 import LoginPage from './pages/LoginPage'
+import SsoCallbackPage from './pages/SsoCallbackPage'
 import MfaSetupPage from './pages/MfaSetupPage'
 import HostsPage from './pages/HostsPage'
 import HostDetailPage from './pages/HostDetailPage'
@@ -89,6 +90,7 @@ function App() {
         <Routes>
           {/* Public */}
           <Route path="/login" element={<LoginPage />} />
+          <Route path="/auth/sso/callback" element={<SsoCallbackPage />} />
 
           {/* Protected — wrapped in AppLayout with sidebar navigation */}
           <Route element={<RequireAuth><AppLayout /></RequireAuth>}>