fix(GRO-391): remove clientSecret from test schema; use internalBaseUrl

Test connection was always 400 because testAuthProviderSchema required
clientSecret, but OIDC discovery only needs issuer/internal URLs.
Aligned admin test endpoint with setup.ts behavior:
- Drop providerId, clientId, clientSecret from schema
- Add optional internalBaseUrl; use it for discovery URL when set
- Frontend now sends issuerUrl + internalBaseUrl (when populated)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/src/pages/Settings.tsx

@@ -235,9 +235,8 @@ export function SettingsPage() {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
-          providerId: authForm.providerId,
           issuerUrl: authForm.issuerUrl,
-          clientId: authForm.clientId,
+          ...(authForm.internalBaseUrl ? { internalBaseUrl: authForm.internalBaseUrl } : {}),
         }),
       });
       const data = await res.json();