Add Authentik SSO via OAuth2/OIDC

Implements Single Sign-On with Authentik alongside the existing
password login. Admins configure Client ID, Client Secret and Base URL
directly in the app; the SSO button on the login page only appears
when the configuration is complete and enabled.

- SsoSetting model + migration (one-row config table)
- sso_provider_id / is_sso_user fields on users (migration)
- SsoController: redirect to Authentik + callback (token exchange,
  userinfo fetch, auto-create unknown users)
- Admin\SsoSettingController + admin/sso/show view with setup guide
  and one-click Redirect URI copy
- Admin dropdown: SSO-Konfiguration entry
- Login page: Authentik button rendered conditionally

No additional Composer packages required.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

routes/web.php

@@ -5,6 +5,8 @@ use App\Http\Controllers\NailPolishController;
 use App\Http\Controllers\UserNailPolishController;
 use App\Http\Controllers\AdminController;
 use App\Http\Controllers\Auth\LoginController;
+use App\Http\Controllers\Auth\SsoController;
+use App\Http\Controllers\Admin\SsoSettingController;
 use App\Http\Controllers\ManufacturerController;
 
 // Startseite
@@ -16,8 +18,12 @@ Route::get('/', function () {
 Route::middleware('guest')->group(function () {
     Route::get('/login', [LoginController::class, 'showLoginForm'])->name('login');
     Route::post('/login', [LoginController::class, 'login']);
+    Route::get('/sso/redirect', [SsoController::class, 'redirect'])->name('sso.redirect');
 });
 
+// SSO Callback (kein guest-Middleware, da Authentik zurückleitet)
+Route::get('/sso/callback', [SsoController::class, 'callback'])->name('sso.callback');
+
 // Logout (nur für eingeloggte Benutzer)
 Route::post('/logout', [LoginController::class, 'logout'])->name('logout')->middleware('auth');
 
@@ -42,6 +48,8 @@ Route::middleware(['auth'])->group(function () {
         Route::delete('/users/{user}', [AdminController::class, 'destroyUser'])->name('users.destroy');
         Route::get('/statistics', [AdminController::class, 'statistics'])->name('statistics');
         Route::get('/users/{user}/collection', [UserNailPolishController::class, 'showUserCollection'])->name('users.collection');
+        Route::get('/sso', [SsoSettingController::class, 'show'])->name('sso.show');
+        Route::put('/sso', [SsoSettingController::class, 'update'])->name('sso.update');
     });
     
     // Nagellack-Verwaltung (nur für Admin)