V2 Handle SSO account restrictions in account settings (#5225)

## Summary
- hide password and username update controls for SSO accounts and show a
managed-account notice
- prevent account update handlers from calling APIs when the user
authenticates via SSO
- expose authenticationType on the user session model and add
translations for new SSO messaging

## Testing
- not run (not requested)


------
[Codex
Task](https://chatgpt.com/codex/tasks/task_b_693ae8144148832888ecf128e66cd3ca)

frontend/public/locales/en-GB/translation.toml

@@ -449,6 +449,7 @@ required = "All fields are required."
 mismatch = "New passwords do not match."
 error = "Unable to update password. Please verify your current password and try again."
 success = "Password updated successfully. Please sign in again."
+ssoDisabled = "Password changes are managed by your identity provider."
 current = "Current password"
 currentPlaceholder = "Enter your current password"
 new = "New password"
@@ -510,6 +511,7 @@ low = "Low"
 title = "Change Credentials"
 header = "Update Your Account Details"
 changePassword = "You are using default login credentials. Please enter a new password"
+ssoManaged = "Your account is managed by your identity provider."
 newUsername = "New Username"
 oldPassword = "Current Password"
 newPassword = "New Password"