feat(sso): move SSO settings into dynamic config

[Haz3-jolt]

Purpose / Description

Move SSO configuration out of boot-time environment setup and into the admin SSO surface. This keeps OIDC, SAML, and SSO-only controls in one place and makes existing deployments migrate cleanly into dynamic settings.

Fixes

No linked issue.

Approach

• Added dynamic settings for OIDC client ID, client secret, and discovery URL.
• Imported legacy OAUTH_*, SSO_ONLY, and SAML_* environment values once when matching dynamic settings are absent.
• Built the OIDC client from dynamic settings during API startup and marked OIDC changes as requiring an API restart.
• Moved SSO-only, OIDC, and SAML controls into folded sections on the SSO tab with a single save action and status pill.
• Kept sensitive values write-only in the UI and added dropdown selection for the SAML default role.
• Updated SSO help mapping and self-hosting, enterprise, and reference docs.
• Removed OIDC settings from .env.example.

How Has This Been Tested?

Learning (optional, can help others)

Reviewed the existing dynamic settings schema, admin settings UI, SAML admin routes, OIDC Authlib setup, and bundled docs loader to keep SSO configuration and help links consistent.

Checklist

Please, go through these checks before submitting the PR.

• You have a descriptive commit message with a short title (first line, max 50 chars).
• You have commented your code, particularly in hard-to-understand areas
• You have performed a self-review of your own code
• UI changes: include screenshots of all affected screens (in particular showing any new or changed strings)

AI Assistance

Was generative AI tooling used to co-author this PR?

• Yes(Please Specify the tool): Pi coding agent
• Was the generated code manually reviewed and tested?

[codecov]

Codecov Report

❌ Patch coverage is 13.66906% with 120 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
observal_cli/cmd_auth.py	2.08%	47 Missing ⚠️
observal-server/api/routes/device_auth.py	19.35%	25 Missing ⚠️
observal-server/services/dynamic_settings.py	14.81%	23 Missing ⚠️
observal-server/api/routes/auth.py	14.28%	12 Missing ⚠️
observal-server/startup.py	0.00%	8 Missing ⚠️
observal-server/api/routes/config.py	16.66%	5 Missing ⚠️

📢 Thoughts on this report? Let us know!