Sso Authorize

Initiate an SSO flow.

Returns a — the frontend should redirect the browser to redirect_url. In production this builds a real SAML AuthnRequest or OIDC /authorize URL. Here we return a stub redirect URL so the flow is exercisable end-to-end.