fix(web-app-moodle): write the two core settings auth_oidc needs where core reads them

Moodle's login page never bounced to Keycloak, which auth_oidc.spec.js:23
asserts and 3 of the 79 failing jobs of run 37252453141 report. Two core
settings were missing from core.

alternateloginurl sat in the loop that passes --component=auth_oidc, so it
landed in mdl_config_plugins under the plugin. Core reads it from mdl_config,
never saw it, and /login/index.php kept rendering its own form. It now has its
own task without --component, which is how 01_manager_ops.yml:67 and
05_ldap_sync.yml:101 already write core settings. README:101 and the
playwright.env.j2:18 nocheck both already claimed this role sets it; the claim
was untrue until now.

Core `auth`, the list of enabled auth plugins, was written only by
05_ldap_sync.yml. Variant 1 of meta/variants.yml is sso without ldap and skips
that file, so oidc was never enabled there, while this file's last task sets
every mdl_user row to auth='oidc' unconditionally. Those users pointed at a
plugin the site had not enabled, so variant 1 admitted no login at all rather
than merely no SSO. 04_oidc.yml now enables oidc itself; 05_ldap_sync.yml runs
after this include and widens the list to oidc,ldap where both are on, so
variant 0 keeps both and its ldap sync at 05_ldap_sync.yml:121 still runs with
ldap in the list.

Measured per variant: variant 0's final auth is unchanged, variant 1 gains
oidc, variants 2 and 3 are untouched. Both sso variants gain the
alternateloginurl core value.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-moodle/tasks/04_oidc.yml

@@ -93,7 +93,6 @@
     - { name: "field_map_lastnamephonetic", value: "name_phonetic_family" }
     - { name: "field_lock_lastnamephonetic", value: "locked" }
     - { name: "field_updatelocal_lastnamephonetic", value: "oneveryloginupdate" }
-    - { name: "alternateloginurl", value: "{{ lookup('tls', application_id, 'url.base') }}{{ MOODLE_OIDC_PLUGIN_RELPATH }}/" }
   loop_control:
     label: "{{ item.name }}"
   shell: >
@@ -102,6 +101,20 @@
     --name={{ item.name }} --set="{{ item.value }}"
   changed_when: false
 
+- name: "🟢 Enable the auth_oidc plugin in Moodle's core auth list"
+  shell: >
+    container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
+    php {{ MOODLE_CLI_DIR }}/cfg.php --name=auth --set=oidc
+  changed_when: false
+
+- name: "🔀 Point the Moodle login page at the auth_oidc entry point"
+  shell: >
+    container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
+    php {{ MOODLE_CLI_DIR }}/cfg.php
+    --name=alternateloginurl
+    --set={{ (lookup('tls', application_id, 'url.base') ~ MOODLE_OIDC_PLUGIN_RELPATH ~ '/') | quote }}
+  changed_when: false
+
 - name: "🔧 Set auth = 'oidc' for all users except guest"
   shell: >
     container exec {{ MOODLE_DB_CONTAINER_ADDRESS }}