Re-sync federation metadata from the IdP

Re-fetches the federation metadata document from the configured IdP metadata URL and refreshes the cached signing certificate, endpoints and issuer details (UI "Re-sync metadata" in the Status panel; toast "Metadata re-synced from IdP"). On success lastSync is updated and the Status panel reflects the new sync time. This keeps assertion validation working across IdP certificate rollovers without manual re-entry. Validation: an SSO configuration must exist for the tenant (else 404 NOT_FOUND); SSO must currently be enabled with a configured idpMetadataUrl — refreshing a disabled or unconfigured connection → 409 CONFLICT; caller must be tenant owner|admin else 403 FORBIDDEN. An unreachable or invalid metadata endpoint surfaces as a failed result, not a silent success. Async & state: Synchronous command — 200 with the refreshed SsoConfiguration (updated lastSync and, if rolled, certificate). Emits a resource.updated SSE frame (kind: iam.sso_configuration, patch: {lastSync, certificate}). No transitional states. Errors: 401 unauthenticated; 403 not a tenant owner/admin; 404 no SSO configuration in scope; 409 CONFLICT when SSO is disabled/unconfigured; 422 the IdP metadata document fetched is malformed or fails signature checks; 500 metadata fetch/persistence failure. Idempotency/Concurrency: Idempotency-Key is optional (recommended); replaying the same key returns the original refresh result instead of re-contacting the IdP, making UI retries safe.