docs.halos.fi still describes prestart-only OIDC client merging

[mairas]

halos-core-containers#202 changed how the OIDC client registration is merged and applied. The published docs describe the old model in three places:

• docs/reference/core-containers.md — the system-binary table says reload-oidc-clients "Regenerates merged OIDC client configuration". It now no-ops when the merge inputs are unchanged, and takes --force.
• docs/architecture/sso.md — "Authelia's prestart script merges all snippets into a single configuration file." Merging also happens in /usr/bin/reload-oidc-clients, driven by halos-oidc-clients-reload.path and once per stack start.
• docs/architecture/sso.md — a removed app's client is dropped "on next restart". The path unit now drops it when the snippet disappears.

Worth describing alongside: the trigger is a snippet write (secret files are not watched, so an app must rewrite its snippet after rotating its secret), and the merge is skipped when the digested inputs match what was last applied.

Source of truth for the new behaviour: docs/SSO_ARCHITECTURE.md and the AGENTS.md "OIDC client registration contract" section in halos-core-containers.