Prefer OpenID for Swagger login when available

[krowvin]

Summary

• Prefer a valid OpenID configuration when Swagger advertises both OpenID and CWMS AAA authentication.
• Continue using CWMS AAA for T7 deployments where it is the available custom login method.
• Remove the /CWMSLogin availability probe, which could mistake an unrelated successful HTML response for a working CWMS AAA login endpoint.

This is a UI hotfix for CWBI/AWS deployments. The dev deployment currently advertises CwmsAAACacAuth even though it is not running with T7/CWMS AAA.
Its /CWMSLogin path returns the generic water.dev landing page with HTTP 200, causing the UI to incorrectly select CWMS AAA instead of the valid OpenID configuration.

The backend should still be corrected so CWBI/AWS deployments do not advertise CWMS AAA when it is unavailable.

When I looked back, it appeared that cwms.dataapi.access.providers stopped controlling active authentication providers after authentication was refactored in #1073. Authenticator now loads every service-provided IdentityProvider whose getScheme() returns a value. Because CwmsAaaIdentityProvider.getScheme() always returns a scheme, CwmsAAACacAuth is included in the generated OpenAPI document even when the configured provider list is KeyAccessManager,OpenID.

A backend fix could fix provider filtering in Authenticator, this keeps the existing provider name mappings:

Related Issue

• Separate Authentication from Authorization. Use single Access Manager. #1073

Validation

• npx.cmd eslint src/pages/swagger-ui/index.jsx --ext js,jsx --report- unused-disable-directives --max-warnings 0
• npm.cmd run build
• Inspected the dev Swagger document and authentication endpoints:
• OpenID discovery and PKCE configuration are available.
• /CWMSLogin returns the generic water.dev HTML page rather than a CWMS AAA login flow.

Checklist

• AI tools used

[krowvin]

Test errors appear db related and not to this PR