feat: enable provider configuration management for hosted admins with…

[beubax]

Description

• Add hosted admin support for viewing and configuring shared provider client credentials from the dashboard.
• Allow principals listed in AUTHSOME_ADMIN_PRINCIPLES to bypass the hosted restrictions for provider client configuration/admin operations.
• Persist shared OAuth scopes when provider client credentials are configured, so later logins do not ask for them again.
• Keep PKCE credential inputs in the main form with Client ID first and Client Secret second.

Motivation and Context

• Hosted deployments needed a simple admin path for managing shared OAuth app credentials from the dashboard.
• Non-admin hosted users should keep the managed experience, while admins should get a local-mode-like provider config view.
• Shared provider config could be saved without scopes, which caused later logins to prompt again for credential inputs/scopes.
• The credential input page was also reordering fields in a confusing way.

How Has This Been Tested?

• Added/updated tests for hosted admin dashboard behavior, provider client persistence, and PKCE input rendering/order.
• Ran:
  • uv run pytest
  • uv run ruff check --fix src/ tests/
  • uv run ruff format src/ tests/
  • uv run ty check src/
  • uv run --with pre-commit pre-commit run --all-files

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• I have read the CONTRIBUTING document.
• All new and existing tests passed.