fix(login): honest SSO state instead of silent 404

Microsoft SSO endpoint exists at auth-service but returns 503
'Microsoft SSO is not configured' for the canvas tenant. Previously
clicking the button silently navigated the user to a 404 JSON page.

handleSSO now probes the endpoint first:
- 3xx -> follow redirect (real SSO flow)
- 503 -> 'Microsoft sign-in is not yet enabled on this tenant'
- 404 -> 'Microsoft sign-in is not wired to this environment yet'
- network error -> surface the reason

Closes Oracle gap #6 with truthful UX while leaving the SSO path
ready to light up once the tenant Azure AD config is in place.

src/scenes/Login.tsx

@@ -52,8 +52,29 @@ export default function Login() {
     }
   };
 
-  const handleSSO = () => {
+  const handleSSO = async () => {
-    window.location.href = "/api/v1/auth/microsoft/login";
+    setError(null);
+    setLoading(true);
+    try {
+      const probe = await fetch("/api/v1/auth/microsoft/login", { method: "GET", redirect: "manual" });
+      if (probe.status >= 300 && probe.status < 400) {
+        window.location.href = "/api/v1/auth/microsoft/login";
+        return;
+      }
+      if (probe.status === 503) {
+        setError("Microsoft sign-in is not yet enabled on this tenant. Use developer sign-in below for now.");
+        return;
+      }
+      if (probe.status === 404) {
+        setError("Microsoft sign-in is not wired to this environment yet. Use developer sign-in below for now.");
+        return;
+      }
+      window.location.href = "/api/v1/auth/microsoft/login";
+    } catch (e) {
+      setError(`Microsoft sign-in unreachable: ${(e as Error).message}`);
+    } finally {
+      setLoading(false);
+    }
   };
 
   return (