This PR adds a hosted UI that IT admins can use to set up SAML connections in a self-serve manner. The SSOReady-managed production instance of this service lives at admin.ssoready.com.

This PR adds:

• An admin_access_tokens table, representing a new kind of auth token. You can exchange an admin access token's one-time-token for an admin session token. These sessions are scoped to a single organization, and grant the authorization to CRUD the SAML connections within that organization.
• An API for app users to create admin access tokens, and CRUD endpoints for SAML connections that work with admin sessions. I opt not to try to get cute here and try to re-use the existing endpoints; we might deduplicate that logic in a later PR if it turns out the similarities here stay in place over time.
• A new single-page application, admin, at the root level of this project. It talks to api, but only in practice uses the endpoints for admin one-time-tokens and SAML connection CRUDing.
• A new card in app's ViewOrganizationPage to create a one-time admin URL.

Here's what it looks like: