Add Authentik SSO via OAuth2/OIDC

Implements Single Sign-On with Authentik alongside the existing
password login. Admins configure Client ID, Client Secret and Base URL
directly in the app; the SSO button on the login page only appears
when the configuration is complete and enabled.

- SsoSetting model + migration (one-row config table)
- sso_provider_id / is_sso_user fields on users (migration)
- SsoController: redirect to Authentik + callback (token exchange,
  userinfo fetch, auto-create unknown users)
- Admin\SsoSettingController + admin/sso/show view with setup guide
  and one-click Redirect URI copy
- Admin dropdown: SSO-Konfiguration entry
- Login page: Authentik button rendered conditionally

No additional Composer packages required.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Http/Controllers/Admin/SsoSettingController.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\SsoSetting;
+use Illuminate\Http\Request;
+
+class SsoSettingController extends Controller
+{
+    public function show()
+    {
+        $sso = SsoSetting::get();
+        return view('admin.sso.show', compact('sso'));
+    }
+
+    public function update(Request $request)
+    {
+        $request->validate([
+            'base_url'      => 'nullable|url|max:255',
+            'client_id'     => 'nullable|string|max:255',
+            'client_secret' => 'nullable|string|max:255',
+            'slug'          => 'nullable|string|max:255',
+        ]);
+
+        $sso = SsoSetting::get();
+
+        $sso->base_url      = rtrim($request->base_url ?? '', '/') ?: null;
+        $sso->client_id     = $request->client_id ?: null;
+        $sso->client_secret = $request->client_secret ?: null;
+        $sso->slug          = $request->slug ?: null;
+        $sso->enabled       = $request->boolean('enabled');
+        $sso->save();
+
+        return redirect()->route('admin.sso.show')->with('success', 'SSO-Einstellungen gespeichert.');
+    }
+}