feat(auth): add SSO-only authentication mode

Require an enabled OIDC-linked superuser before disabling password flows. Track session authentication methods and fail closed across the API, web client, WebSockets, and administrative mutations.

Closes #1002

server/test/e2e/authorization-matrix/route-inventory/manifest.json

@@ -1,7 +1,7 @@
 {
-  "totalRoutes": 452,
+  "totalRoutes": 453,
   "byPermission": {
-    "(none)": 167,
+    "(none)": 168,
     "Permission.ManageMetadataConfig": 34,
     "Permission.EmailSend": 30,
     "Permission.LibraryEditMetadata": 34,

server/test/e2e/authorization-matrix/route-inventory/routes-01.json

@@ -299,6 +299,18 @@
     "allowDefault": false,
     "useGuards": []
   },
+  {
+    "file": "server/src/modules/auth/auth.controller.ts",
+    "className": "AuthController",
+    "methodName": "loginOptions",
+    "httpMethod": "GET",
+    "path": "/auth/login-options",
+    "permissions": [],
+    "libraryAccess": [],
+    "isPublic": true,
+    "allowDefault": false,
+    "useGuards": []
+  },
   {
     "file": "server/src/modules/auth/auth.controller.ts",
     "className": "AuthController",