Fix the OIDC account views, upgrades, and provider resolution raised by code review

The profile and admin user editors rendered the federated identity disabled, and disabled inputs are never submitted while both actions still validate and copy the posted value: under oidc no profile or user could ever be saved, and under db-oidc every save silently wiped the account's provider link. The profile shows the identity read-only (submitted), and the admin editor makes it editable, which is also the remediation the account_link_required error asks for. Profile.jsp also still requested the renamed noPasswordForOidc message key.

Upgrades from the OpenID era now boot: authentication.method values openid and db-openid map to their OIDC replacements with a warning instead of throwing on every request. Linking sees disabled and pending-activation accounts and refuses them cleanly, where before they fell through to provisioning and died on the username unique constraint.

Provider resolution no longer serializes logins on a dead identity provider: findByRegistrationId resolves only the requested provider, discovery runs under a ten second timeout, concurrent requests skip a provider that is already being resolved, and configured scopes are trimmed so "openid, profile, email" works. OIDC login honors Spring Security's saved request, so deep links survive the login roundtrip; the redirect-only success handler class, its test, and two orphaned handler beans are gone.