improvement(sso): fix provider lookup, migrate UI to emcn, add enterprise SSO docs (#4238)
* improvement(sso): fix provider lookup, migrate UI to emcn, add enterprise SSO docs
* fix(sso): add org membership guard on providers route, fix idpMetadata round-trip
* fix(sso): add org membership guard on register route, fix SP entityID, remove fullError leak
* fix(sso): fix SAML script callbackUrl and SP entityID to use app base URL
* fix(sso): correct SAML callback URL path in script header comment
* fix(sso): restrict SSO provider read/write to org owners and admins
* docs(sso): restructure page, fix provider guide accuracy, add external doc links
* fix(sso): correct SAML callback path and generate idpMetadata from cert+entryPoint
* fix(sso): always require NEXT_PUBLIC_APP_URL for SAML SP metadata entityID
* fix(sso): scope provider query to org only when organizationId is provided
* fix(sso): escape XML special chars in script idpMetadata generation
* fix(sso): final audit corrections — saml mapping, xml escaping, self-hosted org guard
* fix(sso): redact oidc client secret in providers response, add self-hosted org admin guard
* fix(sso): scope redacted-secret lookup to caller's org or userId
* fix(sso): null out oidcConfig on parse failure to prevent unredacted secret leak
* fix(sso): use issuer as entityID in auto-generated idp metadata xml