Add Access login method reconciliation

[rogu3bear]

Summary

• add access.login_method as a cataloged cfctl surface for Access app login-method posture
• add inventory and preview-gated set apply backends that resolve existing IdPs, build full Access app PUT bodies, and verify exact allowed_idps readback
• update standards, permissions, docs, capability generation, and fixture/static contract coverage

Test plan

• ./scripts/verify_static_contract.sh
• python3 scripts/render_capabilities_doc.py --check docs/capabilities.md
• python3 scripts/verify_permission_catalog.py --cfctl ./cfctl
• CF_SHARED_ENV_FILE=/Users/star/dev/.env CF_TOKEN_LANE=global ./cfctl list access.login_method
• CF_SHARED_ENV_FILE=/Users/star/dev/.env CF_TOKEN_LANE=global ./cfctl apply access.login_method set --provider-type onetimepin --plan reported target_count=16, update_count=0, noop_count=16

Notes

• No live Access mutation was applied; only read and plan-mode proof was run.
• Recent cfctl contract GitHub runs were already failing on main before this branch, so local static/permission gates are the branch proof here.