feat(login): render SSO button data-driven from /auth/config

The backend now advertises the active external auth provider on
``/auth/config`` as a single ``external_auth: {type, login_url} | null``
field (replacing the per-provider ``is_oidc`` / ``is_saml`` booleans).
This is the API needed to add CAS without per-provider UI conditionals.

Wire the login UI accordingly:

- ``useSSOAuth`` exposes a single ``loginWithExternalAuth()`` action and
  ``options.external_auth`` carrying the provider info; the OIDC- and
  SAML-specific exports are gone.
- ``LoginForm`` renders one SSO button whenever ``external_auth`` is
  set, navigating to ``login_url``. New providers (CAS, future LDAP /
  Azure AD / …) need zero UI changes — only a backend route.
- ``LocalUserForm`` and ``LoginKit`` type definitions drop the
  per-provider booleans.

src/plugins/types.ts

@@ -20,13 +20,15 @@ export interface LoginKit {
   };
   useSSOAuth: (opts: any) => {
     options: {
-      saml: boolean;
-      oidc: boolean;
+      // Active external auth provider (e.g. ``{type: "CAS", login_url:
+      // "/auth/cas/login"}``) or ``null`` when only local login is
+      // configured. The login UI renders an SSO button only when this
+      // is non-null and navigates to ``login_url``.
+      external_auth: { type: string; login_url: string } | null;
       first_time_setup: boolean;
       get_initial_password_command: string;
     };
-    loginWithOIDC: () => void;
-    loginWithSAML: () => void;
+    loginWithExternalAuth: () => void;
   };
   userInfo: any;
   setUserInfo: (info: any) => void;