chore: retire CANOPY_WEB__OIDC_* env vars + synthetic single-IdP fallback

Scope

Remove the four CANOPY_WEB__OIDC_* env vars (oidc_client_id, oidc_external_issuer, oidc_internal_issuer) and the synthetic-single-IdP IdpRuntime fallback path. All operators migrate to the [[idp]] schema in their jurisdiction's idp.toml.

Background

Stage 4 (#493 (closed)/#494 (closed)) ships a backward-compat synthetic-single-IdP fallback so existing devstack deployments don't break when idp.toml has zero [[idp]] entries. The fallback is documented as transitional; once all jurisdictions ship multi-IdP idp.toml, this issue removes the fallback path.

Acceptance

• All deployed jurisdictions have ≥1 [[idp]] entry in their respective rulesets/{juris}/idp.toml
• WebConfig.oidc_client_id, oidc_external_issuer, oidc_internal_issuer fields removed (or kept only in comment as "deprecated; removed in #N")
• IdpRuntime::build no longer has the synthetic-fallback ladder rung
• CHANGELOG entry

References

• Tracking: epic &51 #460
• Stage 4 plan: docs/modules/ROOT/pages/plans/worker-portal-redesign-stage4-idp-loader-and-sign-in.adoc