feat(auth): add SSO-only authentication mode (#1714)

* feat(auth): add SSO-only authentication mode

Let administrators disable interactive local password login when SSO is configured, with backend enforcement, activation safeguards, and host CLI recovery.

Closes #1709

* fix: resolve CI failures in auth mode PR

- Add useLicense mock to SSOSection test to prevent crash from
  AuthenticationModePanel rendering without LicenseProvider
- Remove username from authMode console.log calls that CodeQL flags
  as clear-text logging of sensitive information

* fix(auth): keep SSO-only on named disableSso and fail-closed login

Named provider disable no longer reverts authentication_mode. Login initializes localLoginEnabled false so a status fetch failure cannot reveal the password form. Center a single OIDC provider button on the login card.

* fix(auth): move SSO-only authentication mode from Admiral to Community tier

Security-hardening features belong on the Community tier per the existing
Community rebalance. The reporter of #1709 noted that disabling local
password login after configuring SSO is a basic security measure, not an
enterprise governance feature. LDAP provider configuration remains
Admiral-gated via requireTierForSsoProvider.

* fix(ui): keep SSO Active badge and ON toggle in sync

Provider cards mounted before config fetch finished with enabled:false, so a saved Active provider showed OFF until the local draft was resynced. Drive both the badge and TogglePill from the synced local config.

* feat(auth): auto-redirect to sole OIDC provider under SSO-only

When authentication mode is SSO only and exactly one OIDC provider is enabled (no LDAP), skip the login chooser and send the browser to that provider's authorize URL. Returning sso_error stays on the login page so the failure message remains visible.

* fix(ui): move oidcAutoRedirectUrl out of Login for fast refresh

Exporting the helper alongside the Login component tripped react-refresh/only-export-components and failed Frontend lint CI. Keep Login as a component-only module and colocate the helper with its unit tests under lib/.

backend/src/__tests__/recovery-cli.test.ts

@@ -15,6 +15,7 @@ let resetPassword: typeof import('../cli/resetPassword').resetPassword;
 let createEmergencyAdmin: typeof import('../cli/createEmergencyAdmin').createEmergencyAdmin;
 let clearSessions: typeof import('../cli/clearSessions').clearSessions;
 let disableSso: typeof import('../cli/disableSso').disableSso;
+let enableLocalLogin: typeof import('../cli/enableLocalLogin').enableLocalLogin;
 let validateDb: typeof import('../cli/validateDb').validateDb;
 let backupData: typeof import('../cli/backupData').backupData;
 
@@ -25,6 +26,7 @@ beforeAll(async () => {
     ({ createEmergencyAdmin } = await import('../cli/createEmergencyAdmin'));
     ({ clearSessions } = await import('../cli/clearSessions'));
     ({ disableSso } = await import('../cli/disableSso'));
+    ({ enableLocalLogin } = await import('../cli/enableLocalLogin'));
     ({ validateDb } = await import('../cli/validateDb'));
     ({ backupData } = await import('../cli/backupData'));
 });
@@ -126,6 +128,59 @@ describe('disableSso', () => {
         expect(result.ok).toBe(true);
         expect(db.getEnabledSSOConfigs()).toHaveLength(0);
     });
+
+    it('rejects disabling the last provider while sso_only', () => {
+        const db = DatabaseService.getInstance();
+        db.updateGlobalSetting('authentication_mode', 'sso_only');
+        db.upsertSSOConfig('oidc_custom', true, '{"clientId":"abc"}');
+        for (const cfg of db.getEnabledSSOConfigs()) {
+            if (cfg.provider !== 'oidc_custom') {
+                db.upsertSSOConfig(cfg.provider, false, cfg.config_json);
+            }
+        }
+        const result = disableSso('oidc_custom');
+        expect(result.ok).toBe(false);
+        expect(result.message).toMatch(/last SSO provider/i);
+        expect(db.getEnabledSSOConfigs()).toHaveLength(1);
+        expect(db.getGlobalSettings().authentication_mode).toBe('sso_only');
+    });
+
+    it('preserves sso_only when disabling one of several providers', () => {
+        const db = DatabaseService.getInstance();
+        db.updateGlobalSetting('authentication_mode', 'sso_only');
+        for (const cfg of db.getEnabledSSOConfigs()) {
+            db.upsertSSOConfig(cfg.provider, false, cfg.config_json);
+        }
+        db.upsertSSOConfig('oidc_google', true, '{"clientId":"g"}');
+        db.upsertSSOConfig('oidc_github', true, '{"clientId":"h"}');
+        const result = disableSso('oidc_google');
+        expect(result.ok).toBe(true);
+        expect(result.message).toMatch(/remains SSO only/i);
+        expect(db.getGlobalSettings().authentication_mode).toBe('sso_only');
+        const remaining = db.getEnabledSSOConfigs().map(c => c.provider).sort();
+        expect(remaining).toEqual(['oidc_github']);
+    });
+
+    it('restores local_and_sso before disabling all providers under sso_only', () => {
+        const db = DatabaseService.getInstance();
+        db.updateGlobalSetting('authentication_mode', 'sso_only');
+        db.upsertSSOConfig('oidc_custom', true, '{"clientId":"abc"}');
+        const result = disableSso();
+        expect(result.ok).toBe(true);
+        expect(db.getGlobalSettings().authentication_mode).toBe('local_and_sso');
+        expect(db.getEnabledSSOConfigs()).toHaveLength(0);
+    });
+});
+
+describe('enableLocalLogin', () => {
+    it('sets authentication_mode to local_and_sso', () => {
+        const db = DatabaseService.getInstance();
+        db.updateGlobalSetting('authentication_mode', 'sso_only');
+        const result = enableLocalLogin();
+        expect(result.ok).toBe(true);
+        expect(result.message).toMatch(/Restart Sencho/i);
+        expect(db.getGlobalSettings().authentication_mode).toBe('local_and_sso');
+    });
 });
 
 describe('backupData', () => {