Adds the server-side endpoints the clients expect for Key Connector
(set-key-connector-key, convert-to-key-connector, confirmation-details),
a uses_key_connector flag on users plus migrations, and new
KEY_CONNECTOR_* config options gated behind SSO_ENABLED. SSO logins now
carry amr=external and the login response advertises the connector URL
so the clients pick it up.
The protocol was worked out from the GPL client code only, without
looking at Bitwarden's key-connector repo.