Implement SSO/OIDC identity integration and admin session policy hooks

[niteshpurohit]

Summary

Implement standards-based identity integration with concrete OIDC/OAuth2 and SAML support, plus admin session policy hooks.

Scope

• OIDC/OAuth2-style identity integration points for operator access
• concrete SAML support as a first-class supported contract rather than a vague future extension
• admin-session policy hooks needed by operator governance
• alignment with dashboard authentication and framework-native session behavior
• clear boundaries for how identity assertions, sessions, and operator access controls flow through the product

Acceptance Criteria

• standards-based identity integration expectations are explicit enough for framework and dashboard work to rely on
• SAML support is defined as a concrete supported contract with clear implementation and validation expectations
• governed admin-session behavior is compatible with security and operator workflows
• authentication and policy boundaries are documented clearly