feat: SSO & LDAP authentication for Team Pro (#209)

* feat: SSO & LDAP authentication for Team Pro

Add SSO integration allowing Team Pro users to authenticate via LDAP/Active Directory, Google, GitHub, and Okta identity providers. SSO works alongside password authentication with auto-provisioning and role mapping.

- LDAP bind+search authentication with group-based role mapping
- OIDC/OAuth2 flows with PKCE and CSRF protection for Google, GitHub, Okta
- Auto-provisioning: first SSO login creates a Sencho account automatically
- Role mapping via LDAP group membership or OIDC JWT claims
- SSO settings UI in Settings → SSO with per-provider config and test connection
- SSO login buttons on login page with LDAP toggle
- Environment variable seeding for infrastructure-as-code workflows
- Secrets encrypted at rest via CryptoService (AES-256-GCM)
- Seat limit enforcement during auto-provisioning
- Full documentation: feature docs, quickstart guides, env var reference

* fix: resolve ESLint errors in SSO feature

- Remove unnecessary escape characters in regex character classes
- Remove unused `issuer` variable from OIDC callback handler
- Fix setState-in-effect lint error in Login.tsx by using useState initializer
- Suppress set-state-in-effect for SSOSection fetch pattern (matches existing codebase convention)

docs/getting-started/configuration.mdx

@@ -27,6 +27,20 @@ When you point `COMPOSE_DIR` at a directory, Sencho expects each stack to live i
 | `DATA_DIR` | `/app/data` | Directory where Sencho stores its SQLite database, node registry, and cached metrics. |
 | `NODE_ENV` | `production` | Set automatically in the Docker image. Only change this for local development. |
 
+## SSO environment variables
+
+If you use SSO (Team Pro), configure your identity providers via environment variables:
+
+| Variable | Description |
+|----------|-------------|
+| `SSO_LDAP_ENABLED` | Enable LDAP/AD authentication |
+| `SSO_OIDC_GOOGLE_ENABLED` | Enable Google SSO |
+| `SSO_OIDC_GITHUB_ENABLED` | Enable GitHub SSO |
+| `SSO_OIDC_OKTA_ENABLED` | Enable Okta SSO |
+| `SSO_CALLBACK_URL` | External base URL for OAuth callbacks (required behind reverse proxy) |
+
+For the full SSO configuration reference and setup guides, see [SSO Authentication →](/features/sso).
+
 ## Required volume mounts
 
 ### Docker socket