Add a security setting to disable the internal password login when SSO providers are available. Redirect directly for a single provider, retain provider choices for multiple providers, and fall back to password login when none are configured.

Add the enable-internal-login maintenance command for lockout recovery and migrate existing security settings with the feature disabled.

Fixes OD-2960