feat: comprehensive test suite + SAML auth fixes + mock SAML IdP

Tests (198 unit + 70 e2e = 268 total):
- Add test_api_deps.py: Bearer token auth, get_current_api_user, require_admin
- Add test_wireguard_extended.py: ensure_interface, set_private_key, set_listen_port
- Add test_firewall_extended.py: _nft/_nft_batch errors, jump rules, policies
- Add test_mfa_login.py: MFA redirect, TOTP verify, invalid code, cancel
- Add test_magic_link_page.py: page render, submit, empty email, back to login
- Add test_admin_devices.py: list, filter, create, edit, delete, config dialog
- Add test_admin_rules.py: list, create, edit, delete (all DB-verified)
- Add test_admin_settings.py: defaults, security, OIDC/SAML providers
- Add test_saml_login.py: button visible, redirect, metadata, full login flow

Bug fixes:
- Fix SAML callback to use /auth/complete bridge (same fix as OIDC)
- Fix missing get_settings import in admin settings page
- Add SAML provider buttons to login page
- Make SAML strict mode configurable per-provider

Infrastructure:
- Add mock SimpleSAMLphp IdP to compose.yml with SP config
- Add mock-saml service to CI workflows (release + dev)

docker/mock-saml/saml20-sp-remote.php

@@ -0,0 +1,15 @@
+<?php
+/**
+ * SAML 2.0 remote SP metadata for WireGUI testing.
+ * Registers SPs for dev (port 13000) and e2e test (port 13003).
+ */
+
+// Dev instance
+$metadata['http://localhost:13000/auth/saml/test-saml/metadata'] = [
+    'AssertionConsumerService' => 'http://localhost:13000/auth/saml/test-saml/callback',
+];
+
+// E2E test instance
+$metadata['http://localhost:13003/auth/saml/test-saml/metadata'] = [
+    'AssertionConsumerService' => 'http://localhost:13003/auth/saml/test-saml/callback',
+];