Add backend CAS callback endpoints (redirect → validate ticket → establish
session), frontend SSO login button, and runtime config plumbing. All SSO
server URLs are externalized via SsoProperties with zero company-specific
defaults.
Also fix a pre-existing bug in web/docker-entrypoint.d/30-runtime-config.sh
where auth-related runtime config env vars were not being substituted into
runtime-config.js.