i18n: SettingsAuth — full retrofit (OIDC / SSO admin panel)

Adds settings_auth.* namespace (~70 keys) and applies to every visible
string in the admin-only OIDC / Single Sign-On configuration panel.

Coverage:
- Toasts (issuer_client_required, redirect_required, provider_updated,
  provider_created, provider_deleted, need_active_provider,
  password_login_enabled/disabled)
- Confirm dialogs: delete provider with {name}, disable password login
- Empty states: 'User Management is required' and 'Admin only' guard
  cards with descriptions
- Providers section: title + desc, '+ Add provider' button, env-lock
  badge title + pill, per-row summary line built via row_summary key
  with {issuer}/{link}/{register}/{disabled} interpolation, action
  buttons (Test discovery / Edit / Delete / read-only title), empty
  state, discovery test result headers (OK / failed)
- Provider edit form: Provider Type, Display Name, Issuer URL *,
  Client ID *, Client secret (with new vs edit label variants),
  Redirect URIs *, Add redirect URI button, Remove title, redirect
  note, Scope, Token endpoint auth method + 3 options, Auto-Link
  Existing Users toggle + long desc, Auto-Register New Users toggle
  + long desc, Provider Active toggle + short desc, Admin group claim
  + value fields + descriptions (both conditional), Logo URL field
- Save/Cancel action row: Cancel / Saving… / Save changes / Create
  provider (branches on edit vs new)
- Allow Password Login row + description + env-lock note

Server-side error paths (Could not reach server) now route through
common.errors.cant_reach_server for consistency across settings pages.

Author: thebigjoe1