bug(slm): SSO OAuth-state uses sync get_redis_client() with await → fails against real Redis #10284

Discovered during A2 (#10151) code review.

autobot-slm-backend/user_management/services/sso_service.py (_generate_oauth_state ~line 229, _validate_oauth_state ~line 237, and the SAML relay-state store) call redis = get_redis_client() (default async_client=False → sync redis.Redis) and then await redis.set(...) / await redis.getdel(...). Per autobot_shared/redis_client.py:197 the sync client's methods are NOT awaitable → TypeError against a real Redis. Unit tests pass only because they inject an AsyncMock (false green).

Impact: OAuth/SAML state storage (CSRF protection) is latently broken at runtime — likely unexercised because the enterprise SSO tier is still being built. This also affects the PKCE state code merged in #10254 (#10150), which kept the same await redis.set pattern.

Fix: use the canonical async form redis = await get_redis_client(async_client=True) in these async methods (see redis_client.py docstring lines 236-239). Add a test that exercises a real async client (fakeredis-aioredis), not AsyncMock. A2's #10151 fixes its own new denylist code this way; this issue tracks the pre-existing sso_service.py + PKCE occurrences.