feat(auth): let the login page open on SSO (#441)

The login page always opened on the Email tab, so people who sign in with
SSO had to switch every time.

Two things decide the tab now. AUTH_DEFAULT_METHOD sets the instance
default (email or sso, anything else falls back to email) and is served to
the login page by the new public GET /api/auth/methods, which also reports
which methods are available. On top of that the browser remembers the
method last used, stored in localStorage on a successful email login and
when an SSO sign-in starts.

The tab is resolved once the available methods are known: the remembered
method if it is still available, else the server default if available,
else email, else sso. The tabs are controlled now so a manual switch still
sticks.

useAuthMethods calls the new endpoint instead of the two SSO endpoints.
/api/sso/providers/public is unchanged for anyone else using it.

docs/ENVIRONMENT_VARIABLES.md

@@ -342,6 +342,15 @@ Configure automatic cleanup of old events and data.
 
 Configure authentication methods and SSO.
 
+### Login Page
+
+| Variable | Description | Default | Options |
+|----------|-------------|---------|---------|
+| `AUTH_DEFAULT_METHOD` | Tab the login page opens on when both email and SSO are available. Any other value falls back to `email`. | `email` | `email`, `sso` |
+
+The login page also remembers the method last used in that browser, which wins
+over this default. Anything unrecognised falls back to `email`.
+
 ### Header Authentication (Reverse Proxy SSO)
 
 | Variable | Description | Default | Options |