fix(sso): harden Custom OIDC provider and SSO configuration (#630)

- Add Host header injection validation for OAuth callback URL derivation
  when SSO_CALLBACK_URL is not set (extracted into shared getSSOBaseUrl helper)
- Add startup warning when OIDC providers are enabled without SSO_CALLBACK_URL
- Add diagnostic logging for claim fallback, email changes on re-login,
  and admin seat limit enforcement (gated behind Developer Mode)
- Add Custom OIDC environment variables to .env.example
- Fix stale AdmiralGate comment in SSOSection.tsx
- Fix .env.example section header referencing removed Admiral tier gate
- Fix docs: correct Custom OIDC display name default, replace nonexistent
  DEBUG=true env var reference with Developer Mode toggle
- Add tests for role enforcement (viewer 403), API token scope denial,
  OIDC claim edge cases, Custom OIDC test connection, callback error params
- Refresh SSO settings screenshots

.env.example

@@ -29,7 +29,7 @@ API_RATE_LIMIT=200
 # Increase for environments with many concurrent browser sessions behind shared NAT.
 API_POLLING_RATE_LIMIT=300
 
-# ─── SSO / LDAP Configuration (Admiral) ───────────────────────────
+# ─── SSO / LDAP Configuration ────────────────────────────────────
 
 # LDAP / Active Directory
 SSO_LDAP_ENABLED=false
@@ -59,6 +59,17 @@ SSO_OIDC_OKTA_ISSUER_URL=
 SSO_OIDC_OKTA_CLIENT_ID=
 SSO_OIDC_OKTA_CLIENT_SECRET=
 
+# Custom OIDC (Keycloak, Authentik, Authelia, Zitadel, etc.)
+SSO_OIDC_CUSTOM_ENABLED=false
+SSO_OIDC_CUSTOM_DISPLAY_NAME=Custom OIDC
+SSO_OIDC_CUSTOM_ISSUER_URL=
+SSO_OIDC_CUSTOM_CLIENT_ID=
+SSO_OIDC_CUSTOM_CLIENT_SECRET=
+SSO_OIDC_CUSTOM_SCOPES=openid email profile
+SSO_OIDC_CUSTOM_ID_CLAIM=
+SSO_OIDC_CUSTOM_USERNAME_CLAIM=
+SSO_OIDC_CUSTOM_EMAIL_CLAIM=
+
 # Role mapping (shared across OIDC providers)
 SSO_OIDC_ADMIN_CLAIM=groups
 SSO_OIDC_ADMIN_CLAIM_VALUE=sencho-admins