feat: Studio onboarding wizard — multi-IdP support in Step 2 (FU-MULTI-IDP, refs #499 / epic &51)

Follow-up from MR1c (Studio onboarding wizard, #499 (closed) / epic &51).

Stage 6 MR1c shipped a single-IdP scaffold per ADR-021 §Resolutions D-Q4 (downloadable diff bundle). Multi-IdP authoring is deferred — the bundle's idp.toml has a single [[idp]] entry, while production deployments often need N entries (separate Keycloak realms for partner agencies, separate IdPs for staff vs contractors, etc.).

Scope

• Step 2 of the wizard renders an "Add another IdP" affordance.
• Repeats validation per added IdP entry (slug uniqueness across entries; reserved-slug rejection across all entries).
• WizardDraft grows from a single set of idp_* fields to a Vec.
• bundle.rs render_idp_toml writes N entries.

Out of scope

• IdP discovery probe — separate FU.
• Custom claim mappings — that's #515 (multi-shape claims) territory.

Acceptance

• 2+ IdP entries land in the wizard-generated bundle's idp.toml as a [[idp]] table-array.
• Slug uniqueness enforced across entries.
• Unit + Playwright coverage matches MR1c's single-IdP test grid.