Show SSO landing page instead of immediate redirect

The login page now shows the service name and a "Sign in with MCIAS"
button instead of immediately redirecting to MCIAS. This lets the user
know what service they are logging into before the redirect.

- GET /login renders the landing page with SSO button
- GET /sso/redirect initiates the actual SSO redirect
- Non-SSO login form still works when SSO is not configured

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/webserver/server.go

@@ -95,6 +95,7 @@ func (s *Server) buildRouter() chi.Router {
 	// Public routes (no session required).
 	if s.ssoClient != nil {
 		r.Get("/login", s.handleSSOLogin)
+		r.Get("/sso/redirect", s.handleSSORedirect)
 		r.Get("/sso/callback", s.handleSSOCallback)
 	} else {
 		r.Get("/login", s.handleLoginPage)