feat(server): licence API, mutation gate and feature gates

RequireActiveLicense is mounted on the /api group so new routes are gated by
where they live. GET /api/servers/new is named explicitly: it mints a
pre-registration token, so it mutates despite the method.

server/internal/auth/oidc.go

@@ -63,7 +63,13 @@ func providerForInstance(ctx context.Context, c *gin.Context, instanceID string)
 func HandleOIDCStart(c *gin.Context) {
 	inst, ok := InstanceFromHost(c)
 	if !ok {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "unknown organization host"})
+		c.JSON(http.StatusBadRequest, gin.H{"error": "unknown instance host"})
+		return
+	}
+	// Losing the feature stops new SSO logins. It deliberately does not touch
+	// session validation, so nobody is evicted mid-session.
+	if !services.GetLicenseState(inst.InstanceID).Feature("oidc") {
+		c.Redirect(http.StatusFound, "/login?error=oidc_unavailable")
 		return
 	}
 	ctx := c.Request.Context()