…, final)

Final batch closing #359 in full. Apply the playbook to sso.ts.
30 `as never` casts removed.

src/lib/api/sso.ts:
  + 7 read adapters: adaptSsoProvider (with narrowEnum on provider_type),
    adaptOidcConfig / adaptLdapConfig / adaptSamlConfig (each with
    nullable normalization and attribute_mapping coercion via
    adaptAttributeMapping), adaptLdapTestResult, adaptTokenPair
  + 6 write adapters: adaptCreateOidcRequest / adaptUpdateOidcRequest /
    adaptCreateLdapRequest / adaptUpdateLdapRequest /
    adaptCreateSamlRequest / adaptUpdateSamlRequest — explicit field
    forwarding so a future local-type addition surfaces at typecheck
  + ldapLogin runtime-narrows the SDK's `unknown` 200 response: SDK
    typed `LdapLoginResponses.200: unknown`; adapter validates the
    body has access_token + refresh_token strings before returning,
    throws "missing access_token or refresh_token" otherwise
  + assertData on every successful read

attribute_mapping handling:
  - SDK: `{[key: string]: unknown} | null`
  - Local: `Record<string, string>`
  - adaptAttributeMapping coerces non-string values via String(v) so a
    backend that ever returns a non-string doesn't crash render code.
    Pre-#359 this was hidden by `as never`.

Tests rewritten with realistic SDK fixtures (typed as Sdk* for compile-
time drift detection). New regression tests:
  - listProviders: unknown provider_type narrowed
  - listOidc: non-string attribute_mapping values coerced
  - listLdap / listSaml: nullable fields normalization
  - createOidc: body shape forwarding
  - enableX / disableX: enabled flag pinned
  - ldapLogin: body shape forwarded; missing-fields throw
  - exchangeCode: body shape forwarded

Total #359 progression (closed in full):
  batch 1: monitoring (5) + lifecycle (10)
  batch 2: webhooks (9) + analytics (11)
  batch 3: telemetry (9)
  batch 4: replication (11)
  batch 5: sbom (21)
  batch 6: dependency-track (12)
  batch 7: promotion (10)
  batch 8: security (25)
  batch 9: sso (30)
Grand total: 153 `as never` casts removed across 12 modules.

Closes #359.