Change SSO callback to POST and update UTOIPA paths for broker
endpoints (remove realm prefix from documented paths). Register the
BrokerApiDoc in OpenAPI and switch the router to use post for the
callback handler.

Implement BrokerService for ApplicationService and add core
broker module. Introduce IdentityProviderPresentation and include
identity_providers in RealmLoginSetting, loading only enabled providers
(via new only_enabled arg on repository). Update Postgres repo,
service generics, wiring, and tests accordingly; adjust HTTP handlers
to call through the application service.