Fix template error: pass CSRF func on SSO login page

Go templates require all referenced functions to be defined at parse
time, even in branches that won't execute.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/webserver/server.go

@@ -134,7 +134,7 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 
 // handleSSOLogin renders a landing page with a "Sign in with MCIAS" button.
 func (s *Server) handleSSOLogin(w http.ResponseWriter, r *http.Request) {
-	web.RenderTemplate(w, mcqweb.FS, "login.html", pageData{SSO: true})
+	web.RenderTemplate(w, mcqweb.FS, "login.html", pageData{SSO: true}, s.csrf.TemplateFunc(w))
 }
 
 // handleSSORedirect initiates the SSO redirect to MCIAS.