Returns the read-only OIDC callback URL, SAML ACS URL and SAML SP entityID the deployment derives from its public-edge base URL (base + fixed edge path, trailing-slash normalized). These are the values a tenant administrator must register with the external IdP — never operator free-text. The three values are deployment-wide and identical for every tenant. DEGRADED-VALUE POSTURE — read this before presenting a value for registration: the deriver does NOT validate the deployment's public-edge base URL. When PUBLIC_EDGE_BASE_URL is unset, blank, or reaches the service as an unsubstituted placeholder, this read still answers 200 and the derived values carry that raw setting through unchanged — an empty or path-only URL, or the literal placeholder text as the SAML SP entityID. Nothing refuses and nothing is logged. A client MUST treat any of the three values that is not an absolute https URL as unusable and warn, rather than present it for registration with an external IdP. Required scope: admin.tenant.idp.override.