feat: Studio onboarding wizard — synchronous IdP discovery URL probe in Step 2 (FU-IDP-DISCOVERY-PROBE, refs #499 / epic &51)

Follow-up from MR1c (Studio onboarding wizard, #499 (closed) / epic &51).

MR1c's Step 2 takes the IdP issuer URL as a free-text field and only structurally validates it (scheme + host). A synchronous OIDC discovery probe (GET {issuer}/.well-known/openid-configuration + assert issuer claim matches + assert jwks_uri reachable) would catch typos and misconfigured Keycloak realms before the operator commits the bundle.

Scope

  • Step 2 gains a "Test connection" button next to the issuer_url field.
  • Wizard fires an htmx request to a new POST /v1/studio/idp/probe route on canopy-web.
  • Probe runs server-side (canopy-web has reqwest already) and reports back: success / discovery 404 / discovery TLS error / iss-claim mismatch.
  • Result rendered in a div next to the field (htmx hx-swap).
  • "Test connection" stays optional — wizard still submits without probing (probe is advisory).

Out of scope

  • Automatic re-probe on submit (probe is on demand only).
  • Token-exchange probe — that's Stage 7 territory.

CSP considerations

  • The probe call is canopy-web → IdP (not browser → IdP), so no CORS/CSP concern.
  • htmx target div is on-document; no inline JS.

Acceptance

  • Test connection button fires + reports the four states.
  • Successful probe surfaces the discovered issuer + jwks_uri for operator review.
  • Failed probe gives an actionable error (not just "discovery failed").
  • Unit + Playwright coverage for the four states.