Change part of the connection, or turn single sign-on on or off with `enabled`.

Organization admins only (403 organization_admin_required), on a browser session with a fresh proof in the x-50h-reauth header (401 reauth_required). It needs a person: API keys, connected apps and service accounts get 403 session_required. Every change is written to the organization's audit. Turning it on needs a successful test sign-in since the last provider change (409 sso_test_required) and a verified domain. Turning it off is refused while enforcement is on. OIDC fields on a SAML connection, or SAML fields on an OIDC one, are 400 protocol_mismatch. SAML certificate rotation: new metadata with keepPreviousCertificate: true keeps the certificate in use beside the new one (at most two, 409 too_many_certificates), and removeCertificate (a fingerprint) drops one later (409 last_certificate for the only one); neither needs a new test or turning enforcement off.