refactor: sweep the platform-and-sign-in epic

Split load_config into per-section readers, use contextlib.suppress and a single condition where ruff asked, remove stale noqa comments, add the SIM and RUF100 rules, share the sign_in test helper, align AD-6 with the code and record the remaining deferred findings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/adapters/idp/oidc.py

@@ -89,9 +89,9 @@ class OidcIdp:
 
     def _keyset(self, session: OAuth2Session, jwks_uri: str, *, refresh: bool) -> KeySet:
         with self._lock:
-            if self._keys is not None and not refresh:
-                if self._clock() - self._keys_at < CACHE_SECONDS:
-                    return self._keys
+            fresh = self._clock() - self._keys_at < CACHE_SECONDS
+            if self._keys is not None and not refresh and fresh:
+                return self._keys
         try:
             keys = KeySet.import_key_set(self._get_json(session, jwks_uri))
         except (JoseError, ValueError, KeyError) as exc: