Stop offering identity-provider sign-in in the installer

[rbardaji]

Closes #223.

The installer asked whether to offer sign-in through the identity provider, then asked for a client id. No answer leads anywhere:

• The clients a Federation registration creates are confidential (publicClient: False, client-secret authenticator), so the browser's code exchange is refused with unauthorized_client / "Invalid client or Invalid client credentials" — after a successful login, which reads as a credentials problem and is not one.
• The platform's own client is confidential too, and its secret is not an Endpoint's to have.
• Even with the exchange moved off the browser, the tokens these clients mint carry no sub claim, and AUTH_API_URL looks the user up by sub: it answers 500 {"error": "Failed to retrieve user details", "details": "Role query failed"}. Requesting the scope that would supply it answers invalid_scope, since it is assigned to those clients neither by default nor optionally.

So the question is removed. The prompts are now:

  Configuration id (blank to skip):
  Which local catalog should this Endpoint use?
  Register this Endpoint with the Federation now? [Y/n]:
  Organization name [My-Organization]:
  Endpoint name [my_endpoint]:
  Port to publish the Endpoint on [8003]:
  Authentication service (AAI) URL [...]:

The OIDC_* settings are untouched: still documented in example.env and docs/configuration.md, still read by the API and the UI. A deployment that has a working client switches sign-in on by editing .env; the installer simply never turns it on. install/README.md now says why, in place of the older explanation that no longer describes the real obstacle.

Verified

• An interactive run driven through a pty asks the seven questions above and no more, and renders OIDC_ENABLED=False.
• 1204 tests, black --check . and flake8 clean.