feat: Implement customer invitation infrastructure in Authentik

- Added IInvitationSetupService and InvitationSetupService to orchestrate the setup of invitation infrastructure for customers.
- Introduced methods for creating groups, enrollment flows, invitation stages, roles, and policies in Authentik.
- Updated PostInstanceInitService to call the new invitation setup methods during post-initialization.
- Enhanced InstanceService to pass customer name during SAML configuration deployment.
- Updated App.axaml.cs to register the new IInvitationSetupService.
- Modified settings-custom.php.template to include documentation for SAML authentication configuration with group-based admin assignment.
- Added logic to exclude specific groups from being synced to Xibo during group synchronization.

OTSSignsOrchestrator.Core/Services/InstanceService.cs

@@ -253,7 +253,7 @@ public class InstanceService
             // This must happen before the stack is deployed so Xibo starts with SAML
             // authentication already configured.
             var instanceUrlForSaml = $"https://{cmsServerName}/{abbrev}";
-            await _postInit.DeploySamlConfigurationAsync(abbrev, instanceUrlForSaml, _settings, default);
+            await _postInit.DeploySamlConfigurationAsync(abbrev, instanceUrlForSaml, _settings, dto.CustomerName);
 
             // ── 6. Deploy stack ─────────────────────────────────────────────
             var deployResult = await _docker.DeployStackAsync(stackName, composeYaml);