Require single sign-on for addresses on the verified domains, or stop requiring it.

Organization admins only (403 organization_admin_required), on a browser session with a fresh proof in the x-50h-reauth header (401 reauth_required). It needs a person: API keys, connected apps and service accounts get 403 session_required. Every change is written to the organization's audit. On: email codes stop for those addresses and passkey sign-in is kept only for break-glass owners. It can only be turned on by an admin whose own test sign-in since the last change worked (409 sso_test_required), so nobody locks themselves out. Off is always allowed.