Check if email domain has SSO enabled

Routes the login screen: answers whether the email's domain uses single sign-on and whether password sign-in is disabled for it. Unauthenticated. Rate limit: 10 requests per minute per client IP, counted on this endpoint's own bucket — separate from, and in addition to, the shared /v1/auth/* per-IP bucket. Every call counts, including ones rejected with 400. Over the limit the endpoint answers 429 with Retry-After (seconds until the 60-second window resets) before any lookup is made.