Add Authentik SSO via OAuth2/OIDC

Implements Single Sign-On with Authentik alongside the existing
password login. Admins configure Client ID, Client Secret and Base URL
directly in the app; the SSO button on the login page only appears
when the configuration is complete and enabled.

- SsoSetting model + migration (one-row config table)
- sso_provider_id / is_sso_user fields on users (migration)
- SsoController: redirect to Authentik + callback (token exchange,
  userinfo fetch, auto-create unknown users)
- Admin\SsoSettingController + admin/sso/show view with setup guide
  and one-click Redirect URI copy
- Admin dropdown: SSO-Konfiguration entry
- Login page: Authentik button rendered conditionally

No additional Composer packages required.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Models/SsoSetting.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class SsoSetting extends Model
+{
+    protected $table = 'sso_settings';
+
+    protected $fillable = [
+        'base_url',
+        'client_id',
+        'client_secret',
+        'slug',
+        'enabled',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'enabled' => 'boolean',
+        ];
+    }
+
+    public static function get(): self
+    {
+        return static::firstOrCreate([]);
+    }
+
+    public function isConfigured(): bool
+    {
+        return $this->enabled
+            && !empty($this->base_url)
+            && !empty($this->client_id)
+            && !empty($this->client_secret);
+    }
+
+    public function authorizeUrl(): string
+    {
+        return rtrim($this->base_url, '/') . '/application/o/authorize/';
+    }
+
+    public function tokenUrl(): string
+    {
+        return rtrim($this->base_url, '/') . '/application/o/token/';
+    }
+
+    public function userInfoUrl(): string
+    {
+        return rtrim($this->base_url, '/') . '/application/o/userinfo/';
+    }
+}

app/Models/User.php

@@ -22,6 +22,8 @@ class User extends Authenticatable
         'email',
         'password',
         'is_admin',
+        'sso_provider_id',
+        'is_sso_user',
     ];
 
     /**
@@ -43,7 +45,8 @@ class User extends Authenticatable
     {
         return [
             'email_verified_at' => 'datetime',
-            'password' => 'hashed',
+            'password'          => 'hashed',
+            'is_sso_user'       => 'boolean',
         ];
     }