test(sso): add test coverage for encrypted credential storage #9685

Context

PR #9676 implements encrypted storage for SSO credentials but has zero test coverage for a security-critical change.

Required Test Coverage

1. Integration tests for SSOSecretsManager:

   • Creating SSO provider stores secrets in SystemSecret table
   • Updating provider updates encrypted secrets
   • Deleting provider removes all associated secrets
   • Plaintext migration to encrypted storage
   • Decryption failures are handled gracefully

2. End-to-end OAuth flow tests:

   • OAuth authorization with encrypted client_secret
   • Token exchange with encrypted credentials
   • Userinfo retrieval

3. End-to-end LDAP tests:

   • LDAP connection with encrypted bind_password
   • Authentication flow

4. Migration script tests:

   • Migrate sample SSO providers from plaintext to encrypted
   • Verify all secrets are properly encrypted
   • Verify config references are correct
   • Handle providers with missing/empty secrets

Acceptance Criteria

• All critical paths have integration test coverage
• Tests verify secrets are actually encrypted in database
• Tests verify secrets can be decrypted and used
• Migration script has test coverage
• All tests pass

Related

• PR fix(security): move SSO credentials to encrypted SystemSecret storage (MVA-1737) #9676
• MVA-1737