Add SSO configuration and login flows

[miki3421]

Summary

• add ops config sso keycloak for OIDC provider configuration
• store confidential client secret only in a Kubernetes Secret and mount it into admin-api
• use backend-managed device flow when a confidential client is configured
• add explicit password-grant SSO login mode for headless environments
• assert SSO config enable/disable rolls admin-api by default

Tests

• go test ./auth ./config