Add SSO login support

- Add [sso] config section with redirect_uri
- Create mcdsl/sso client when SSO is configured
- Add /login (landing page), /sso/redirect, /sso/callback routes
- Add /logout route
- Update login template with SSO landing page variant
- Bump mcdsl to v1.6.0

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vendor/github.com/go-viper/mapstructure/v2/internal/errors/errors.go

@@ -0,0 +1,11 @@
+package errors
+
+import "errors"
+
+func New(text string) error {
+	return errors.New(text)
+}
+
+func As(err error, target interface{}) bool {
+	return errors.As(err, target)
+}

vendor/github.com/go-viper/mapstructure/v2/internal/errors/join.go

@@ -0,0 +1,9 @@
+//go:build go1.20
+
+package errors
+
+import "errors"
+
+func Join(errs ...error) error {
+	return errors.Join(errs...)
+}

vendor/github.com/go-viper/mapstructure/v2/internal/errors/join_go1_19.go

@@ -0,0 +1,61 @@
+//go:build !go1.20
+
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package errors
+
+// Join returns an error that wraps the given errors.
+// Any nil error values are discarded.
+// Join returns nil if every value in errs is nil.
+// The error formats as the concatenation of the strings obtained
+// by calling the Error method of each element of errs, with a newline
+// between each string.
+//
+// A non-nil error returned by Join implements the Unwrap() []error method.
+func Join(errs ...error) error {
+	n := 0
+	for _, err := range errs {
+		if err != nil {
+			n++
+		}
+	}
+	if n == 0 {
+		return nil
+	}
+	e := &joinError{
+		errs: make([]error, 0, n),
+	}
+	for _, err := range errs {
+		if err != nil {
+			e.errs = append(e.errs, err)
+		}
+	}
+	return e
+}
+
+type joinError struct {
+	errs []error
+}
+
+func (e *joinError) Error() string {
+	// Since Join returns nil if every value in errs is nil,
+	// e.errs cannot be empty.
+	if len(e.errs) == 1 {
+		return e.errs[0].Error()
+	}
+
+	b := []byte(e.errs[0].Error())
+	for _, err := range e.errs[1:] {
+		b = append(b, '\n')
+		b = append(b, err.Error()...)
+	}
+	// At this point, b has at least one byte '\n'.
+	// return unsafe.String(&b[0], len(b))
+	return string(b)
+}
+
+func (e *joinError) Unwrap() []error {
+	return e.errs
+}