feat: enterprise SSO — home-realm discovery + multi-issuer routing

[gmoon]

Context

fz-auth federates to a single OIDC issuer today. B2B apps need "sign in with your company's IdP" (Okta, Entra ID, Google Workspace, ...). Key framing: for enterprise SSO the app is the relying party consuming the customer's IdP — it does not need to be an IdP — which fits the BFF model directly (each enterprise IdP is just another upstream issuer).

Proposal

Extend the BFF to support multiple upstream issuers, selected per-organization by home-realm discovery:

• Connection config — per-tenant (org/domain, issuer, client_id, client_secret, protocol), behind a pluggable store interface.
• Home-realm discovery — resolve email domain -> connection -> upstream issuer; fall back to the default (social) issuer when there is no connection.
• Per-issuer OIDC discovery + caching (multiple .well-known docs).
• JIT provisioning hook — callback on first login so the consumer creates/links a user + membership.

Keep the simple case simple: single-issuer setups are unaffected; multi-issuer is opt-in.

Acceptance criteria

• Connection-store interface + reference impl
• resolveIssuer(email) home-realm resolver
• Multi-issuer discovery + caching in the BFF routes
• JIT-provisioning callback hook
• Example + docs

Out of scope

• SCIM / directory sync (separate concern; often delegated to a broker).
• SAML SP support (this issue is OIDC federation; SAML can be a follow-up).
• The concrete connection datastore (pluggable).