Implement SSO

Add SAML/OIDC, IdP-initiated login, and the admin portal. Then stop.

Guardrails

• MUST pass one selector on every authorization URL: connectionId, organizationId, or loginHint.
• MUST keep redirectUri identical to the dashboard Allowed callback URL.
• MUST call validateToken before using claims.
• MUST keep relay_state as state on IdP-initiated login.
• MUST print dashboard checklists, wait for the user, then continue. Do not click the dashboard.

Gotchas