Test the SSO connection to the IdP

Runs a connectivity and configuration test against the configured identity provider (UI "Test connection" in the Identity provider panel). The backend resolves the IdP metadata URL, validates the entity ID / issuer match and checks that the configured X.509 certificate can validate a sample assertion, returning a success/failure verdict with a human-readable message — the UI surfaces it as a toast such as "Connection test succeeded — IdP reachable". The test never mutates the stored configuration. Validation: an SSO configuration must exist for the tenant (else 404 NOT_FOUND); SSO must be enabled — the UI hints "Enable SSO to test" and a disabled connection → 409 CONFLICT; caller must be tenant owner|admin else 403 FORBIDDEN. Async & state: Synchronous probe — 200 with an SsoConnectionTestResult capturing success, message and testedAt. No resource state change and no SSE frames; an unreachable IdP is reported inside the 200 result as success: false rather than a transport error. Errors: 401 unauthenticated; 403 not a tenant owner/admin; 404 no SSO configuration in scope; 409 CONFLICT when SSO is disabled; 429 the test endpoint is rate-limited to protect the IdP; 500 unexpected probe infrastructure failure. Idempotency/Concurrency: Idempotency-Key is optional (recommended) since the UI can retry the POST; replay returns the original test verdict without re-probing the IdP. No If-Match — nothing is mutated.