Fleet Desktop SSO: organization settings UI and activity feed

[juan-fdz-hawa]

Related user story

#47116

Task

Adds the "End user authentication" radio group to Settings > Organization settings > Fleet Desktop per Figma — "Hourly token rotation" (sso_enabled: false, default) vs "Single sign-on (SSO)" (true), with the SSO radio disabled + tooltip when no IdP is configured, everything disabled in GitOps mode, and the section description updated. Also registers the two new activities in the activity feed.

Condition of satisfaction

Settings card:

• Radio group renders per Figma (labels, order, default) under the Browser host field; section description updated.
• No IdP configured → SSO radio disabled, tooltip text exactly: "This setting requires an IdP configured in Settings > Integrations > Authentication (SSO) > End users."
• IdP configured → selectable; Save round-trips the value (persists after refetch).
• GitOps mode → both radios disabled; Save wrapped in the GitOps tooltip (existing behavior preserved for the other fields).
• Free tier → card renders nothing / nav hides Fleet Desktop (existing behavior at FleetDesktop.tsx:102-104, OrgSettingsPage.tsx:109-113) — unchanged.
• Server 422 (e.g. IdP cleared in another tab) surfaces through the page's existing error toast path (OrgSettingsPage.tsx:76-97).

Activity feed:

• Both activities render with the agreed copy; no console warnings for unknown activity types.

Tests/commands:

• yarn test green, including new FleetDesktop and GlobalActivityItem cases.
• make lint-js clean.