Enterprise SSO: verify OIDC E2E against real IdP + SAML/SCIM decision records

[teetangh]

Verified state: BetterAuth sso() plugin registered (auth/index.ts:173) w/ org provisioning + domainVerification; org owners register OIDC providers (org-sso.ts); admin trust flip at /admin/sso; sign-in surface exists. OIDC is genuinely implemented — but never tested end-to-end. SAML advertised in schema only. SCIM absent.

• E2E harness: test tenant + Okta dev account; register→verify→work-email sign-in→JIT membership→seat claim; Playwright spec (mocked OIDC); fix whatever breaks
• SAML decision record: recommend defer (OIDC covers Okta/AzureAD/Google Workspace); trigger conditions for a bridge later
• SCIM: design-only doc (/api/scim/v2 routes, org-scoped bearer tokens, Users↔Member mapping) — build only when >100-seat buyer requires it
• Admin queue polish at /admin/sso; issuer .well-known validation before provider save
• Regression: unverified providers can never authenticate

Spec: temp prompt library 07-enterprise-sso-scim.