Move SSO clients from config to database

- Add sso_clients table (migration 000010) with client_id, redirect_uri,
  tags (JSON), enabled flag, and audit timestamps
- Add SSOClient model struct and audit events
- Implement DB CRUD with 10 unit tests
- Add REST API: GET/POST/PATCH/DELETE /v1/sso/clients (policy-gated)
- Add gRPC SSOClientService with 5 RPCs (admin-only)
- Add mciasctl sso list/create/get/update/delete commands
- Add web UI admin page at /sso-clients with HTMX create/toggle/delete
- Migrate handleSSOAuthorize and handleSSOTokenExchange to use DB
- Remove SSOConfig, SSOClient struct, lookup methods from config
- Simplify: client_id = service_name for policy evaluation

Security:
- SSO client CRUD is admin-only (policy-gated REST, requireAdmin gRPC)
- redirect_uri must use https:// (validated at DB layer)
- Disabled clients are rejected at both authorize and token exchange
- All mutations write audit events

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/model/model.go

@@ -221,8 +221,26 @@ const (
 
 	EventSSOAuthorize = "sso_authorize"
 	EventSSOLoginOK   = "sso_login_ok"
+
+	EventSSOClientCreated = "sso_client_created"
+	EventSSOClientUpdated = "sso_client_updated"
+	EventSSOClientDeleted = "sso_client_deleted"
 )
 
+// SSOClient represents a registered relying-party application that may use
+// the MCIAS SSO authorization code flow. The ClientID serves as both the
+// unique identifier and the service_name for policy evaluation.
+type SSOClient struct {
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+	CreatedBy   *int64    `json:"-"`
+	ClientID    string    `json:"client_id"`
+	RedirectURI string    `json:"redirect_uri"`
+	Tags        []string  `json:"tags"`
+	ID          int64     `json:"-"`
+	Enabled     bool      `json:"enabled"`
+}
+
 // ServiceAccountDelegate records that a specific account has been granted
 // permission to issue tokens for a given system account.  Only admins can
 // add or remove delegates; delegates can issue/rotate tokens for that specific