* fix(auth): validate IdP authority before SAML account linking Adds verification that SAML IdP is authoritative for the email domain before allowing account conversion * fix(auth): deny by default on missing SAML tenant + optimize membership query - Block account conversion when tenant is missing (deny by default) - Replace JOIN + ILIKE with two indexed lookups for O(1) performance * refactor(auth): apply data minimization to security logs