feat(saml): wire SAML 2.0 SSO end-to-end (pure-Rust) + Settings/Storage UI consolidation (v0.5.1)

SAML SSO (the config was storage-only since v0.4.5; now it logs you in):
- New openpxe-core::saml — pure-Rust SP built on bergshamra (XML-DSig +
  exclusive c14n via RustCrypto, no OpenSSL/xmlsec/libxml2). The static
  musl binary stays C-free; samael was rejected for hard-requiring OpenSSL.
  * metadata.rs   — parse IdP EntityDescriptor (SSO URLs + signing certs),
                    build our SP metadata.
  * authn_request.rs — build + HTTP-Redirect-encode AuthnRequests.
  * response.rs   — verify the signature against the pinned IdP cert
                    (trusted_keys_only + strict_verification for XSW),
                    then enforce Status/Destination/Audience/time-bounds/
                    signature-scope. Stateless; returns the IDs the HTTP
                    layer needs.
- http-api saml_routes: GET /api/sso/login (302 to IdP), POST /api/sso/acs
  (verify -> InResponseTo correlation / IdP-initiated gating / assertion
  replay guard -> mint operator session -> 302), GET /api/sso/metadata.
  Added to the pre-auth allowlist; /api/sso config stays gated.
- SsoConfig gains entity_id (SP Entity ID, defaults to public base URL)
  and allow_idp_initiated (default off), mirroring FleetDM.
- Access model: any IdP-authenticated, cryptographically-verified user gets
  an operator session (single-tier; local admin remains the fallback owner).
- Login page: the "Sign in with <IdP>" button now drives the real flow and
  surfaces sso_error redirects.

UI consolidation:
- Removed the Advanced sidebar tab; folded its webhook-notifications +
  API-reference cards into a collapsible "Advanced" disclosure at the
  bottom of Settings.
- Merged the Storage tab's separate SMB and NFS cards into one "Remote
  shares" card with a protocol dropdown and a unified, protocol-badged
  table. No backend changes — same /api/smb-shares + /api/nfs-shares.

Tests: 17 SAML core tests (accept + reject tampered/unsigned/wrong-key/
wrong-audience/expired/future/wrong-issuer/non-success) and 6 ACS
integration tests (happy path, IdP-initiated gating, SP correlation,
replay, garbage). Full workspace: 206 tests green, clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/http-api/src/state.rs

@@ -1,5 +1,6 @@
-use crate::uploads::UploadSessions;
 use crate::auth::SessionStore;
+use crate::saml_routes::SamlRuntime;
+use crate::uploads::UploadSessions;
 use openpxe_core::{
     AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
     Metrics, NotifyStore, SettingsStore, SsoStore,
@@ -34,9 +35,13 @@ pub struct AppState {
     /// process restart (sessions are tied to UI state, not persisted —
     /// matches Sonarr/Radarr behaviour).
     pub sessions: SessionStore,
-    /// SAML SSO configuration. v0.4.5 stores it; the actual SSO login
-    /// flow ships in a later release.
+    /// SAML SSO configuration (persisted IdP metadata, Entity ID, toggles).
     pub sso: SsoStore,
+    /// v0.5.1: in-memory SAML runtime state — outstanding AuthnRequest IDs
+    /// (for InResponseTo correlation), consumed-assertion replay guard, and
+    /// a cache of fetched IdP metadata. Tied to process lifetime, like
+    /// `sessions`; a restart simply invalidates any in-flight SSO login.
+    pub saml: SamlRuntime,
     /// v0.5.0: webhook / email notification config (Slack/Teams/Discord/
     /// SMTP). Drives the fire-and-forget pings on boot events and powers
     /// the Advanced tab's config + "Send test" button.