Retry / reprovision SSO command

[aivuk]

Recover from Keycloak being unavailable during tenant creation.

Tasks:

• php artisan tenant:provision-sso {tenant} [--update]
  • --update allows overwriting existing IdP config (changed
    client_secret, new mappers, etc.)
  • Re-runs TenantIdpProvisioner for an existing tenant
• php artisan tenant:list --sso-status=failed to surface tenants needing
  attention
• Filament filter on the tenant list for sso_provisioning_status = failed
• Filament action button "Reprovision SSO" on the tenant detail page
• On success: clear sso_provisioning_error, set status=ok, update
  sso_provisioned_at

Tests: command behavior for missing-IdP and existing-IdP cases.