Implement SSO

Add SAML/OIDC, IdP-initiated login, and the admin portal. Then stop.

Guardrails

• MUST pass one selector on every authorization URL: connectionId, organizationId, or loginHint.
• MUST keep redirectUri identical to the dashboard Allowed callback URL.
• MUST call validateToken before using claims.
• MUST keep relay_state as state on IdP-initiated login.
• MUST print dashboard checklists. Do not click the dashboard. MUST write the Node files and stop. MUST NOT run npm install or start the server.

Gotchas