POST check-nitrate-sso

Check if a user needs to login into the organization SSO. Accepts either team-id (to look up the organization via the team) or organization-id directly. Returns {:authorized true :reason :sso-satisfied} when SSO is not active or the session already holds a valid entry for the organization, and {:authorized true :reason :no-team-access} when the gate was skipped because the user cannot access the team; the reason lets the client tell a usable session apart from a plain permission failure. Returns {:authorized false :redirect-uri <url>} when SSO is active; the client must redirect there. The OIDC provider itself handles re-authentication transparently if the user already has an active SSO session. A nil :redirect-uri means SSO is required but the provider is not usable.