Add SSO login support

- Add [sso] config section with redirect_uri
- Create mcdsl/sso client when SSO is configured
- Add /login (landing page), /sso/redirect, /sso/callback routes
- Add /logout route
- Update login template with SSO landing page variant
- Bump mcdsl to v1.6.0

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/login.html

@@ -7,8 +7,14 @@
 </div>
 <div class="card">
     <div class="card-title">Sign In</div>
-    <p>Authenticate with your MCIAS credentials.</p>
     {{if .Error}}<div class="error">{{.Error}}</div>{{end}}
+    {{if .SSO}}
+    <p>Sign in to manage cryptographic engines, certificates, and keys.</p>
+    <div class="form-actions">
+        <a href="/sso/redirect" style="display:block;text-align:center;text-decoration:none;"><button type="button" style="width:100%">Sign in with MCIAS</button></a>
+    </div>
+    {{else}}
+    <p>Authenticate with your MCIAS credentials.</p>
     <form method="POST" action="/login">
         {{csrfField}}
         <div class="form-group">
@@ -27,5 +33,6 @@
             <button type="submit">Login</button>
         </div>
     </form>
+    {{end}}
 </div>
 {{end}}