fix(sso): enforce hub-only SSO config when remote node is active (#1865)

SSO configuration is control-plane state and must not follow the active
remote node. Add /api/sso/ to hub-only prefixes with case-insensitive
matching, hide the Settings section on remotes, and use localOnly on
every SSOSection fetch as defense in depth.

frontend/src/lib/routing/reachability.test.ts

@@ -151,4 +151,9 @@ describe('reachability', () => {
     expect(isSettingsSectionHidden('sso', nodeAdmin)).toBe(true);
     expect(isSettingsSectionHidden('recovery', nodeAdmin)).toBe(true);
   });
+
+  it('hides SSO for admins when a remote node is active', () => {
+    const adminRemote = ctx({ isAdmin: true, isRemote: true });
+    expect(isSettingsSectionHidden('sso', adminRemote)).toBe(true);
+  });
 });