Make the login routes and the allowlist's reach settable

[JeroenDeDauw]

Follows-up to #4 (shares the login form and the captcha handling). Panel counterpart: https://github.com/ProfessionalWiki/ProAdmin/pull/1346, which makes both settings admin-editable.

Makes the login routes and the allowlist's reach settable instead of everything switching on together. No existing setting changed meaning; the defaults reproduce the behavior before this PR.

$wgMemberAccessCodeLogin — allowlisted (default), open (anyone who can receive mail at the address they enter gets a read-only member account; their roster row has no group), or off (no button, no codes — held across the whole AuthManager flow, including logins already in progress). $wgMemberAccessApplyAllowlistToSso — true by default; false leaves single sign-on entirely alone: nothing refused, nothing logged, and the accounts it creates are ordinary accounts that re-enabling does not reach, since accounts that are not members are exempt. Such accounts are absent from the roster and untouched by panel deactivation; an admin deals with them by hand (an ordinary block keeps them out). With the code route off and SSO left alone, the allowlist is manageable while governing nothing.

• A group-less member is assigned their group at the next login once a matching entry exists, over either route; an existing group is never moved.
• open is documented as an abuse surface: per-address limits bound one mailbox, and an address-varying attacker meets only the per-IP limits — meant for wikis behind another gate, such as an internal network.
• Count login code requests against the member's own throttle #4's captcha-trigger relaxation now applies only while the code route exists.
• The deactivated-member short-circuit, decoy codes, collision defence and password veto hold in every mode.

Verification: full suite and PHPStan level 9 (no baseline) green locally and on CI. The login form's new address field (from #4) has not been browser-checked on this branch — one click-through before undrafting.

Considered, omitted: a three-state SSO setting (off/allowlisted/open) that would also provision ungated SSO logins — the follow-up if the SSO-off cohort should be governed rather than documented; conditioning the other wiki-wide changes on the routes; deduplicating the code-login test helpers.

_{AI-authored — Claude Code, Fable 5 (max); decomposition directed by @JeroenDeDauw after his design questions, implementation and review by Opus 5 (max) subagents with findings adjudicated by Fable; diff not yet human-reviewed; TDD suite green locally and on CI, cross-PR adversarial review applied, browser check of the #4 form shape pending.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 97.33333% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.22%. Comparing base (87dadb0) to head (37ba174).

Files with missing lines	Patch %	Lines
src/Persistence/DatabaseRepository.php	0.00%	2 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master       #5      +/-   ##
============================================
+ Coverage     82.63%   86.22%   +3.59%     
- Complexity      455      481      +26     
============================================
  Files            57       58       +1     
  Lines          1572     1626      +54     
============================================
+ Hits           1299     1402     +103     
+ Misses          273      224      -49     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.