Per-org OIDC SSO & JIT enrollment

Per-organization single sign-on via OpenID Connect (OIDC): employees are routed to their own identity provider by verified email domain and just-in-time (JIT) enrolled into the org on first login, with identity-provider groups optionally mapped straight to a DekEn role.

• An enterprise customer wants staff to log in with their existing corporate identity provider, not a DekEn password
• You're standing up SSO for a new org and need the setup order (domain verification comes first)
• You want IdP group membership to drive DekEn role assignment automatically instead of manual per-user role edits

OIDC routes a login by the user's email domain to the org's configured identity provider; a first-time login auto-enrolls (JIT) the user into that org rather than requiring manual pre-creation; an optional group→role mapping translates IdP groups into DekEn roles, capped so SSO alone can never grant more than a site-manager-level role. Domain ownership is proven with a DNS TXT record before routing activates.