Show SSO landing page instead of immediate redirect

The login page now shows the service name and a "Sign in with MCIAS"
button instead of immediately redirecting to MCIAS. This lets the user
know what service they are logging into before the redirect.

- GET /login renders the landing page with SSO button
- GET /sso/redirect initiates the actual SSO redirect
- Non-SSO login form still works when SSO is not configured

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/login.html

@@ -2,10 +2,14 @@
 
 {{define "content"}}
 <div class="login-container">
-    <h1>MCR Login</h1>
+    <h1>Metacircular Container Registry</h1>
     {{if .Error}}
     <div class="error">{{.Error}}</div>
     {{end}}
+    {{if .SSO}}
+    <p>Sign in to manage container images, policies, and audit logs.</p>
+    <a href="/sso/redirect" class="btn">Sign in with MCIAS</a>
+    {{else}}
     <form method="POST" action="/login">
         <input type="hidden" name="_csrf" value="{{.CSRFToken}}">
         <div class="form-group">
@@ -18,5 +22,6 @@
         </div>
         <button type="submit">Sign In</button>
     </form>
+    {{end}}
 </div>
 {{end}}