Configure SAML SSO for organization (owner only)

Every allowed_domains entry is normalized (trimmed, lowercased, trailing dot stripped) and must be owned by this organization: either already bound to it, or covered by a DNS-TXT-verified domain claim (/domains) held by this org or by the calling owner's personal org. Unverified domains → 403 sso_domain_unverified; public email providers (gmail.com, outlook.com, ...) → 400 sso_domain_public; a domain already bound to another organization's SSO → 409 sso_domain_conflict. metadata_url — Outbound URL rules: the URL must be https and must point at a publicly reachable host. Credentials in the URL, single-label or internal host names (localhost, *.local, *.internal, *.home.arpa), and hosts that are or resolve to loopback, private (RFC1918), link-local (including cloud metadata), CGNAT, IPv6 unique-local/link-local, or other non-public addresses are rejected with 400. The host is resolved and checked when saved; the identity provider fetches it from there.