dotAuth improvements

Description

Five small improvements to the dotAuth portlet, found while debugging a Google OIDC login on the intranet and while testing whether dotAuth could take over a classic SAML private key.

1. Show the effective redirect URI on the OIDC connection form (override or window.location.origin plus /api/v1/oauth/callback, mirroring OAuthWebInterceptor.computeCallbackUrl), with a copy-to-clipboard button and a note that it must be registered at the IdP.
2. Make the default roles field obviously comma separated (tooltip wording plus exampleRole1, exampleRole2 placeholder).
3. Remove the header "Test connection" button on the OIDC form; it only re-runs discovery, which already has its own button and inline result.
4. Stop silently regenerating the SAML keypair when a save carries neither private key nor certificate on an existing config. Require an explicit regenerateKeypair flag, confirm in the UI, and return 400 otherwise.
5. Surface the server's validation message on a rejected save instead of the generic "HTTP Status 400 - Bad Request" dialog (return a JSON ResponseEntityView from DotAuthResource and read it in the store's error path).

Acceptance Criteria

• OIDC form shows the live redirect URI under the callback override with a working copy button.
• Default roles tooltip says comma separated role keys; placeholder is exampleRole1, exampleRole2.
• Header "Test connection" button and its i18n key are gone; inline discovery still works.
• SAML keypair regeneration requires an explicit flag and a UI confirmation; new configs still auto-generate.
• Rejected saves show the server's message in the UI.
• Vitest specs and backend unit tests cover each change.

Priority

Medium

Start with OAuthWebInterceptor.computeCallbackUrl for the redirect URI behavior, then trace the OIDC form, DotAuthResource save response, and the store's error path. Use the named Vitest specs and backend unit tests to cover the form changes, keypair regeneration rules, and validation-message handling. Done means every acceptance criterion passes, including explicit SAML regeneration confirmation and working inline discovery.