feat(enterprise): add SSO enforcement mode with break-glass admin

apps/api/src/index.ts

@@ -21,6 +21,7 @@ import { shouldRunStartupCleanup } from "./lib/cleanup.js";
 import { buildCsp } from "./lib/csp.js";
 import { ensureAiDirs, recoverInterruptedInstalls } from "./lib/feature-status.js";
 
+import { getSettingString } from "./lib/settings-helpers.js";
 import { requirePermission } from "./permissions.js";
 import {
   authMiddleware,
@@ -438,6 +439,8 @@ app.get("/api/v1/config/auth", async () => {
     config.samlLoginUrl = "/api/auth/saml/login";
   }
 
+  config.ssoEnforced = (await getSettingString("ssoEnforcement", "false")) === "true";
+
   return config;
 });