fix(auth): validate IdP authority before SAML account linking (#26005)

* fix(auth): validate IdP authority before SAML account linking

Adds verification that SAML IdP is authoritative for the email domain
before allowing account conversion

* fix(auth): deny by default on missing SAML tenant + optimize membership query

 - Block account conversion when tenant is missing (deny by default)
 - Replace JOIN + ILIKE with two indexed lookups for O(1) performance

* refactor(auth): apply data minimization to security logs

apps/web/app/(use-page-wrapper)/auth/error/page.tsx

@@ -47,6 +47,8 @@ const ServerPage = async ({ searchParams }: PageProps) => {
           ? "SAML (like Okta)"
           : "your original login method";
       return t("account_managed_by_identity_provider_error", { provider: providerName });
+    } else if (error === "saml-idp-not-authoritative") {
+      return t("saml_idp_not_authoritative_error");
     }
     return t("error_during_login") + (error ? ` Error code: ${error}` : "");
   };

apps/web/public/static/locales/en/common.json

@@ -4168,6 +4168,7 @@
   "timestamp": "Timestamp",
   "json": "JSON",
   "hubspot_ignore_guests": "Do not create new records for guests added to the booking",
+  "saml_idp_not_authoritative_error": "This SAML identity provider is not authorized to manage your account. Please sign in with your original login method.",
   "audit_logs_organization_required": "You must be part of an organization to view audit logs.",
   "audit_logs_booking_not_found_or_permission_denied": "Booking not found or you do not have permission to view its audit logs.",
   "audit_logs_booking_has_no_owner": "Cannot verify permissions: booking has no associated user.",