docs: correct rbac.md against engine main and settle the Okta setup page

[catinspace-au]

Follow-up to #783. Three things, all docs.

• docs/control-plane/idp-setup/README.md -- a landing page for the three IdP pages: which page, which provider type, what a group links on, the shared redirect URI.
• docs/control-plane/idp-setup/okta.md -- the org authorization server sends no groups claim in the ID token, so that alternative is gone. The default custom server is the one path. A claim with no scope condition arrives whether or not groups is requested, and the scope and access-policy checks stay.
• docs/control-plane/rbac.md -- accuracy only, checked against main:
  • auth paths: the X-Oidc-* headers need auth.trust_proxy_auth_headers, and auth disabled needs a dev DFE_ENV
  • API keys default to a 90-day TTL (auth.api_key_default_ttl_days)
  • roles live in rbac/roles.yaml, there are 8 built-in roles (dfe_operator), custom roles go through /api/v1/auth/roles
  • the permission table matches the scope catalogue (delete actions, source:deploy, transform not transforms, no dashboard:write)
  • authorize() takes a scope and decides on scoped grants
  • the auth routes and CRUD prefixes are listed
  • the OIDC adapter diagram and table match the code (Okta is not a stub, Google reads Cloud Identity as the user, Entra reads Graph on overage)
  • the audit table lists what is emitted, and says group, API key, account and role CRUD emit nothing
  • the settings block lists the fields actually read
  • edge cases for multi-role, ClickHouse down and the default password match the code

No restructure, no cuts beyond the corrections. Done when this is on main with CI green.