Feature: Auto-provision new users on first SSO login (no manual admin invite required)

Summary New users who successfully authenticate via SSO (Keycloak OIDC) for the first time are silently rejected and kicked back to the Vaultwarden login screen with no explanation. There is no self-service onboarding path — an admin must manually invite each user from the admin panel before SSO will work for them. Current Behavior 1. New user completes the full SSO flow (Vaultwarden email input → Keycloak login → redirect back) 2. Keycloak authenticates them successfully 3. Vaultwarden silently rejects them — no account exists, no error shown, no action taken 4. User is returned to the login screen with empty fields 5. No invite email is sent automatically 6. Admin must manually go to /admin → Users → Invite for each new user before they can log in Expected Behavior When a user authenticates via SSO for the first time and no Vaultwarden account exists for their email: Option A (preferred): Automatically send an invite email to the user's address (as returned by the IdP tok…