feat(enterprise): add SAML 2.0 SSO with SP-initiated login

Implements SAML SSO using @node-saml/node-saml, gated behind
SAML_ENABLED env var and the saml_sso enterprise license feature.

- SAML env vars (entity ID, callback URL, IdP SSO URL, IdP cert,
  auto-create/auto-link users, default role, provider name,
  username/email attribute mapping) with validation in superRefine
- SAML plugin with three routes: metadata (GET), login (GET),
  and ACS callback (POST with form-urlencoded content type parser)
- Callback uses the shared external-auth resolver for user
  resolution (same pattern as OIDC: match/link/create/deny)
- Auth config endpoint exposes samlEnabled and samlProviderName
- Session loginMethod detection updated for SAML auth provider
- Frontend login page shows SAML SSO button when enabled
- i18n strings for SAML error messages across all 21 locales

packages/shared/src/i18n/ar.ts

@@ -2997,6 +2997,11 @@ export const ar: TranslationKeys = {
     oidcUserNotAuthorized: "حسابك غير مصرح له بالوصول إلى هذا التطبيق. تواصل مع المسؤول.",
     oidcUserLimitReached: "تم الوصول لحد المستخدمين. تواصل مع المسؤول.",
     oidcGenericError: "خطأ في المصادقة. يرجى المحاولة مرة أخرى.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "يتم إدارة تغيير كلمة المرور بواسطة مزود الهوية الخاص بك.",
     enterUsername: "أدخل اسم المستخدم",
     enterPassword: "أدخل كلمة المرور",

packages/shared/src/i18n/de.ts

@@ -3024,6 +3024,11 @@ export const de: TranslationKeys = {
       "Ihr Konto ist nicht fuer den Zugriff auf diese Anwendung autorisiert. Kontaktieren Sie Ihren Administrator.",
     oidcUserLimitReached: "Benutzerlimit erreicht. Kontaktieren Sie Ihren Administrator.",
     oidcGenericError: "Authentifizierungsfehler. Bitte versuchen Sie es erneut.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider:
       "Passwortaenderungen werden von Ihrem Identitaetsanbieter verwaltet.",
     enterUsername: "Benutzernamen eingeben",

packages/shared/src/i18n/en.ts

@@ -2963,6 +2963,11 @@ export const en = {
       "Your account is not authorized to access this application. Contact your administrator.",
     oidcUserLimitReached: "User limit reached. Contact your administrator.",
     oidcGenericError: "Authentication error. Please try again.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "Password changes are managed by your identity provider.",
     enterUsername: "Enter username",
     enterPassword: "Enter your password",

packages/shared/src/i18n/es.ts

@@ -3002,6 +3002,11 @@ export const es: TranslationKeys = {
       "Tu cuenta no esta autorizada para acceder a esta aplicacion. Contacta a tu administrador.",
     oidcUserLimitReached: "Limite de usuarios alcanzado. Contacta a tu administrador.",
     oidcGenericError: "Error de autenticacion. Intenta de nuevo.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider:
       "Los cambios de contrasena son administrados por tu proveedor de identidad.",
     enterUsername: "Ingresa tu nombre de usuario",

packages/shared/src/i18n/fr.ts

@@ -3022,6 +3022,11 @@ export const fr: TranslationKeys = {
       "Votre compte n'est pas autorise a acceder a cette application. Contactez votre administrateur.",
     oidcUserLimitReached: "Limite d'utilisateurs atteinte. Contactez votre administrateur.",
     oidcGenericError: "Erreur d'authentification. Veuillez reessayer.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider:
       "Les modifications de mot de passe sont gerees par votre fournisseur d'identite.",
     enterUsername: "Saisissez votre nom d'utilisateur",

packages/shared/src/i18n/hi.ts

@@ -2994,6 +2994,11 @@ export const hi: TranslationKeys = {
       "आपके अकाउंट को इस एप्लिकेशन तक पहुंचने की अनुमति नहीं है। अपने एडमिनिस्ट्रेटर से संपर्क करें।",
     oidcUserLimitReached: "उपयोगकर्ता सीमा पहुंच गई। अपने एडमिनिस्ट्रेटर से संपर्क करें।",
     oidcGenericError: "ऑथेंटिकेशन त्रुटि। कृपया पुनः प्रयास करें।",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "पासवर्ड बदलाव आपके आइडेंटिटी प्रोवाइडर द्वारा प्रबंधित किए जाते हैं।",
     enterUsername: "यूज़रनेम दर्ज करें",
     enterPassword: "अपना पासवर्ड दर्ज करें",

packages/shared/src/i18n/id.ts

@@ -3010,6 +3010,11 @@ export const id: TranslationKeys = {
       "Akun Anda tidak diizinkan mengakses aplikasi ini. Hubungi administrator Anda.",
     oidcUserLimitReached: "Batas pengguna tercapai. Hubungi administrator Anda.",
     oidcGenericError: "Kesalahan autentikasi. Silakan coba lagi.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "Perubahan kata sandi dikelola oleh penyedia identitas Anda.",
     enterUsername: "Masukkan nama pengguna",
     enterPassword: "Masukkan kata sandi Anda",

packages/shared/src/i18n/it.ts

@@ -3016,6 +3016,11 @@ export const it: TranslationKeys = {
       "Il tuo account non e autorizzato ad accedere a questa applicazione. Contatta l'amministratore.",
     oidcUserLimitReached: "Limite utenti raggiunto. Contatta l'amministratore.",
     oidcGenericError: "Errore di autenticazione. Riprova.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider:
       "Le modifiche alla password sono gestite dal tuo provider di identita.",
     enterUsername: "Inserisci il nome utente",

packages/shared/src/i18n/ja.ts

@@ -2967,6 +2967,11 @@ export const ja: TranslationKeys = {
       "お使いのアカウントにはこのアプリケーションへのアクセス権がありません。管理者にお問い合わせください。",
     oidcUserLimitReached: "ユーザー上限に達しました。管理者にお問い合わせください。",
     oidcGenericError: "認証エラー。もう一度お試しください。",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "パスワードはIDプロバイダーで管理されています。",
     enterUsername: "ユーザー名を入力",
     enterPassword: "パスワードを入力",

packages/shared/src/i18n/ko.ts

@@ -2952,6 +2952,11 @@ export const ko: TranslationKeys = {
       "귀하의 계정은 이 애플리케이션에 접근할 권한이 없습니다. 관리자에게 문의하세요.",
     oidcUserLimitReached: "사용자 한도에 도달했습니다. 관리자에게 문의하세요.",
     oidcGenericError: "인증 오류. 다시 시도해 주세요.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "비밀번호는 ID 제공자에서 관리됩니다.",
     enterUsername: "사용자명 입력",
     enterPassword: "비밀번호 입력",

packages/shared/src/i18n/nl.ts

@@ -3013,6 +3013,11 @@ export const nl: TranslationKeys = {
       "Je account heeft geen toegang tot deze applicatie. Neem contact op met je beheerder.",
     oidcUserLimitReached: "Gebruikerslimiet bereikt. Neem contact op met je beheerder.",
     oidcGenericError: "Authenticatiefout. Probeer het opnieuw.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "Wachtwoordwijzigingen worden beheerd door je identiteitsprovider.",
     enterUsername: "Voer gebruikersnaam in",
     enterPassword: "Voer je wachtwoord in",

packages/shared/src/i18n/pl.ts

@@ -3020,6 +3020,11 @@ export const pl: TranslationKeys = {
       "Państwa konto nie ma uprawnień do korzystania z tej aplikacji. Skontaktuj się z administratorem.",
     oidcUserLimitReached: "Osiągnięto limit użytkowników. Skontaktuj się z administratorem.",
     oidcGenericError: "Błąd uwierzytelniania. Spróbuj ponownie.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "Zarządzanie hasłem odbywa się przez dostawcę tożsamości.",
     enterUsername: "Wprowadź nazwę użytkownika",
     enterPassword: "Wprowadź hasło",

packages/shared/src/i18n/pt-BR.ts

@@ -3013,6 +3013,11 @@ export const ptBR: TranslationKeys = {
       "Sua conta nao esta autorizada a acessar este aplicativo. Entre em contato com o administrador.",
     oidcUserLimitReached: "Limite de usuarios atingido. Entre em contato com o administrador.",
     oidcGenericError: "Erro de autenticacao. Tente novamente.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider:
       "Alteracoes de senha sao gerenciadas pelo seu provedor de identidade.",
     enterUsername: "Digite seu nome de usuario",

packages/shared/src/i18n/ru.ts

@@ -3012,6 +3012,11 @@ export const ru: TranslationKeys = {
       "Вашей учётной записи не предоставлен доступ к этому приложению. Обратитесь к администратору.",
     oidcUserLimitReached: "Достигнут лимит пользователей. Обратитесь к администратору.",
     oidcGenericError: "Ошибка аутентификации. Попробуйте снова.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "Управление паролем осуществляется Вашим провайдером идентификации.",
     enterUsername: "Введите имя пользователя",
     enterPassword: "Введите пароль",

packages/shared/src/i18n/sv.ts

@@ -3008,6 +3008,11 @@ export const sv: TranslationKeys = {
       "Ditt konto har inte behorighet till denna applikation. Kontakta din administrator.",
     oidcUserLimitReached: "Anvandargrans nadd. Kontakta din administrator.",
     oidcGenericError: "Autentiseringsfel. Forsok igen.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "Losenordsandringar hanteras av din identitetsleverantor.",
     enterUsername: "Ange anvandarnamn",
     enterPassword: "Ange ditt losenord",

packages/shared/src/i18n/th.ts

@@ -2985,6 +2985,11 @@ export const th: TranslationKeys = {
     oidcUserNotAuthorized: "บัญชีของคุณไม่ได้รับอนุญาตให้เข้าถึงแอปพลิเคชันนี้ กรุณาติดต่อผู้ดูแลระบบ",
     oidcUserLimitReached: "ถึงจำนวนผู้ใช้สูงสุดแล้ว กรุณาติดต่อผู้ดูแลระบบ",
     oidcGenericError: "ข้อผิดพลาดในการยืนยันตัวตน กรุณาลองอีกครั้ง",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "การเปลี่ยนรหัสผ่านจัดการโดยผู้ให้บริการยืนยันตัวตนของคุณ",
     enterUsername: "กรอกชื่อผู้ใช้",
     enterPassword: "กรอกรหัสผ่านของคุณ",

packages/shared/src/i18n/tr.ts

@@ -3016,6 +3016,11 @@ export const tr: TranslationKeys = {
       "Hesabınız bu uygulamaya erişim yetkisine sahip değil. Yöneticinizle iletişime geçin.",
     oidcUserLimitReached: "Kullanıcı limitine ulaşıldı. Yöneticinizle iletişime geçin.",
     oidcGenericError: "Kimlik doğrulama hatası. Lütfen tekrar deneyin.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider:
       "Parola değişiklikleri kimlik sağlayıcınız tarafından yönetilmektedir.",
     enterUsername: "Kullanıcı adını girin",

packages/shared/src/i18n/uk.ts

@@ -3013,6 +3013,11 @@ export const uk: TranslationKeys = {
       "Ваш обліковий запис не має доступу до цього застосунку. Зверніться до адміністратора.",
     oidcUserLimitReached: "Досягнуто ліміту користувачів. Зверніться до адміністратора.",
     oidcGenericError: "Помилка автентифікації. Спробуйте знову.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "Керування паролем здійснюється Вашим постачальником ідентифікації.",
     enterUsername: "Введіть ім'я користувача",
     enterPassword: "Введіть пароль",

packages/shared/src/i18n/vi.ts

@@ -3008,6 +3008,11 @@ export const vi: TranslationKeys = {
       "Tài khoản của bạn không được phép truy cập ứng dụng này. Liên hệ quản trị viên.",
     oidcUserLimitReached: "Đã đạt giới hạn người dùng. Liên hệ quản trị viên.",
     oidcGenericError: "Lỗi xác thực. Vui lòng thử lại.",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "Việc đổi mật khẩu được quản lý bởi nhà cung cấp danh tính của bạn.",
     enterUsername: "Nhập tên đăng nhập",
     enterPassword: "Nhập mật khẩu của bạn",

packages/shared/src/i18n/zh-CN.ts

@@ -2937,6 +2937,11 @@ export const zhCN: TranslationKeys = {
     oidcUserNotAuthorized: "您的账号无权访问此应用。请联系管理员。",
     oidcUserLimitReached: "用户数量已达上限。请联系管理员。",
     oidcGenericError: "认证错误。请重试。",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "密码修改由您的身份提供商管理。",
     enterUsername: "输入用户名",
     enterPassword: "输入密码",

packages/shared/src/i18n/zh-TW.ts

@@ -2935,6 +2935,11 @@ export const zhTW: TranslationKeys = {
     oidcUserNotAuthorized: "您的帳戶無權存取此應用程式。請聯絡管理員。",
     oidcUserLimitReached: "已達使用者上限，請聯絡管理員。",
     oidcGenericError: "驗證錯誤，請重試。",
+    samlAuthFailed: "SAML authentication failed. Please try again.",
+    samlUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    samlUserLimitReached: "User limit reached. Contact your administrator.",
+    methodSaml: "SAML",
     passwordManagedByProvider: "密碼由您的身分提供者管理。",
     enterUsername: "輸入使用者名稱",
     enterPassword: "輸入密碼",