Save the SSO configuration

Updates the tenant's Single Sign-On configuration (UI "Save configuration"). Editable fields mirror the the SSO page form: enablement, protocol (SAML 2.0 / OIDC), display name, IdP metadata URL, entity ID / issuer, the X.509 signing certificate, and the "disable local password sign-in" security policy. Server-managed fields (acsUrl, verified domains, lastSync) cannot be changed here. Enforcing disableLocalPassword forces all members through SSO while break-glass owner accounts remain exempt — the UI warns to verify a break-glass login first. Validation: all IdP fields (protocol, displayName, idpMetadataUrl, entityId, certificate) are required when enabled: true — missing/blank → 422 VALIDATION_FAILED; idpMetadataUrl must be a well-formed HTTPS URL and certificate a parseable X.509 PEM block → 422; disableLocalPassword: true is rejected with 409 CONFLICT when no owner has a verified break-glass login; attempts to set server-managed fields → 422; caller must be tenant owner|admin else 403 FORBIDDEN. Async & state: Synchronous mutation — 200 with the persisted configuration; the connection status pill flips between Connected/Not configured immediately. Emits a resource.updated SSE frame (kind: iam.sso_configuration, patch: {enabled, protocol, displayName, disableLocalPassword}). Errors: 401 unauthenticated; 403 not a tenant owner/admin; 404 scope not found; 409 CONFLICT enforcing SSO-only sign-in without a verified break-glass owner; 412 If-Match mismatch on concurrent edit; 422 invalid or non-editable fields; 500 persistence failure. Idempotency/Concurrency: This operation does not use Idempotency-Key; it may be omitted and a sent one is ignored. A repeated identical PATCH saves the same configuration again (same end state) and advances updatedAt, which changes the ETag, so resending a request that already succeeded with its original If-Match gets 412. If-Match with the ETag from the list read prevents overwriting a concurrent configuration change.