### Check for existing issues

- [X] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

The `PATCH /update/sso_settings` endpoint accepts the full `SSOConfig` model and serializes it with `model_dump()` without `exclude_unset=True`. Any optional field omitted by the caller is serialized as `None`, persisted into the encrypted SSO settings blob, and (for env-var-backed fields) used to clear the corresponding environment variable. As a result, updating one SSO field (for example `ui_access_mode`) can wipe out unrelated stored secrets such as `google_client_secret`, `microsoft_client_secret`, and `generic_client_secret`.

**Observed:** The handler builds `sso_data = sso_config.model_dump()`, which materializes every optional field that the caller omitted as `None`. The full serialized object is then encrypted and upserted under `sso_settings`, and any env-var-backed field whose serialized value is falsey is removed from `os.environ`. Previously stored SSO client secrets are silently lost, and the next SSO login fails until an operator re-enters the credentials.

**Expected:** A partial update should only modify the fields supplied in…