Move SSO clients from config to database

- Add sso_clients table (migration 000010) with client_id, redirect_uri,
  tags (JSON), enabled flag, and audit timestamps
- Add SSOClient model struct and audit events
- Implement DB CRUD with 10 unit tests
- Add REST API: GET/POST/PATCH/DELETE /v1/sso/clients (policy-gated)
- Add gRPC SSOClientService with 5 RPCs (admin-only)
- Add mciasctl sso list/create/get/update/delete commands
- Add web UI admin page at /sso-clients with HTMX create/toggle/delete
- Migrate handleSSOAuthorize and handleSSOTokenExchange to use DB
- Remove SSOConfig, SSOClient struct, lookup methods from config
- Simplify: client_id = service_name for policy evaluation

Security:
- SSO client CRUD is admin-only (policy-gated REST, requireAdmin gRPC)
- redirect_uri must use https:// (validated at DB layer)
- Disabled clients are rejected at both authorize and token exchange
- All mutations write audit events

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/ui/ui.go

@@ -501,6 +501,10 @@ func (u *UIServer) Register(mux *http.ServeMux) {
 	uiMux.Handle("DELETE /policies/{id}", admin(u.handleDeletePolicyRule))
 	uiMux.Handle("PUT /accounts/{id}/tags", admin(u.handleSetAccountTags))
 	uiMux.Handle("PUT /accounts/{id}/password", admin(u.handleAdminResetPassword))
+	uiMux.Handle("GET /sso-clients", adminGet(u.handleSSOClientsPage))
+	uiMux.Handle("POST /sso-clients", admin(u.handleCreateSSOClientUI))
+	uiMux.Handle("PATCH /sso-clients/{clientId}/toggle", admin(u.handleToggleSSOClient))
+	uiMux.Handle("DELETE /sso-clients/{clientId}", admin(u.handleDeleteSSOClientUI))
 
 	// Service accounts page — accessible to any authenticated user; shows only
 	// the service accounts for which the current user is a token-issue delegate.
@@ -923,6 +927,12 @@ type PolicyRuleView struct {
 	IsPending   bool // true if not_before is in the future
 }
 
+// SSOClientsData is the view model for the SSO clients admin page.
+type SSOClientsData struct {
+	PageData
+	Clients []*model.SSOClient
+}
+
 // PoliciesData is the view model for the policies list page.
 type PoliciesData struct {
 	PageData