feat: comprehensive SSO/OIDC upgrade with enterprise features

Multi-provider SSO support:
   - Database-backed SSO provider management with admin UI
   - Support for OpenID Connect, Google OAuth2, GitHub, and SAML 2.0
   - Flipper feature flag (db_sso_providers) for dynamic provider loading
   - ProviderLoader service for YAML or database configuration

   Admin functionality:
   - Admin::SsoProvidersController for CRUD operations
   - Admin::UsersController for super_admin role management
   - Pundit policies for authorization
   - Test connection endpoint for validating provider config

   User provisioning improvements:
   - JIT (just-in-time) account creation with configurable default role
   - Changed default JIT role from admin to member (security)
   - User attribute sync on each SSO login
   - Group/role mapping from IdP claims

   SSO identity management:
   - Settings::SsoIdentitiesController for users to manage connected accounts
   - Issuer validation for OIDC identities
   - Unlink protection when no password set

   Audit logging:
   - SsoAuditLog model tracking login, logout, link, unlink, JIT creation
   - Captures IP address, user agent, and metadata

   Advanced OIDC features:
   - Custom scopes per provider
   - Configurable prompt parameter (login, consent, select_account, none)
   - RP-initiated logout (federated logout to IdP)
   - id_token storage for logout

   SAML 2.0 support:
   - omniauth-saml gem integration
   - IdP metadata URL or manual configuration
   - Certificate and fingerprint validation
   - NameID format configuration

app/controllers/settings/sso_identities_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+class Settings::SsoIdentitiesController < ApplicationController
+  layout "settings"
+
+  def show
+    @oidc_identities = Current.user.oidc_identities.order(:provider)
+    @breadcrumbs = [
+      [ t("settings.nav.home"), root_path ],
+      [ t(".page_title"), nil ]
+    ]
+  end
+
+  def destroy
+    @identity = Current.user.oidc_identities.find(params[:id])
+
+    # Prevent unlinking last identity if user has no password
+    if Current.user.oidc_identities.count == 1 && Current.user.password_digest.blank?
+      redirect_to settings_sso_identities_path, alert: t(".cannot_unlink_last")
+      return
+    end
+
+    provider_name = @identity.provider
+    @identity.destroy!
+
+    # Log account unlinking
+    SsoAuditLog.log_unlink!(
+      user: Current.user,
+      provider: provider_name,
+      request: request
+    )
+
+    redirect_to settings_sso_identities_path, notice: t(".success", provider: provider_name)
+  end
+end