fix(auth): link SCIM-provisioned users through SSO and surface sign-in errors

SCIM provisioning created users with emailVerified: false, so better-auth
refused to link the matching SSO account (account_not_linked), and the
resulting redirect landed on better-auth's bare /error page with no
actionable feedback.

- Mark SCIM-provisioned users as email-verified at creation time, same
  trust rationale already applied to admin-invited credential users.
- Sync a SCIM user's membership role to the organization's configured
  default role instead of the hardcoded "member" the SCIM plugin creates.
- Set errorCallbackURL/onAPIError.errorURL to the sign-in page so failed
  SSO/OAuth callbacks land back on Dokploy's UI instead of better-auth's
  generic error page.
- Read the error query param on the sign-in page and show it through the
  existing AlertBlock instead of failing silently.

Fixes #4973

apps/dokploy/components/proprietary/auth/sign-in-with-github.tsx

@@ -13,6 +13,7 @@ export function SignInWithGithub() {
 		try {
 			const { error } = await authClient.signIn.social({
 				provider: "github",
+				errorCallbackURL: "/",
 			});
 			if (error) {
 				toast.error(error.message);

apps/dokploy/components/proprietary/auth/sign-in-with-google.tsx

@@ -13,6 +13,7 @@ export function SignInWithGoogle() {
 		try {
 			const { error } = await authClient.signIn.social({
 				provider: "google",
+				errorCallbackURL: "/",
 			});
 			if (error) {
 				toast.error(error.message);

apps/dokploy/components/proprietary/sso/sign-in-with-sso.tsx

@@ -50,6 +50,7 @@ export function SignInWithSSO({
 			const { data, error } = await authClient.signIn.sso({
 				email: values.email,
 				callbackURL: "/dashboard/home",
+				errorCallbackURL: "/",
 			});
 			if (error) {
 				toast.error(error.message ?? "Failed to sign in with SSO");