feat(sso): implement sudo sso

[SkyDev125]

Summary

• What changed:
  • Added sso-backed sudo verification for sso-managed users.
  • Added API routes to start/complete sso sudo reauth and issue the sudo token.
  • Wired the frontend sudo prompt to offer sso for users with the sso trait.
  • Hid local email/password/totp/passkey management for sso-managed users.
  • Added regression coverage for sso sudo and account security capability gating.
• Why it is correct:
  • sso sudo validates that the callback state was created for the current user and that the provider identity resolves to the same account before issuing a sudo token.
  • Existing sudo retry behavior is reused by storing the issued sudo token in the normal sudo token path.
  • Local auth management controls are gated from the exact sso trait, matching how sso-managed accounts are marked.
• Risk:
  • Medium: touches auth, sudo-mode, and account security UI.

Fixes #1254, fixes #1267

Verification

• Tests run:
  • fluxer_api: SsoFlow.test.ts passed (39/39).
  • fluxer_api: Core authentication, password resets/changes, and sudo modes
    (AuthSudoPasswordVerification.test.ts, AuthSudoRequiredOperations.test.ts,
    AuthSudoTOTPVerification.test.ts, PasswordChange.test.ts, PasswordReset.test.ts,
    SudoModeNegativeCases.test.ts, PasswordChangeFlow.test.ts) passed (51/51).
  • fluxer_app: AccountSecurityCapabilities.test.ts passed (5/5).
  • fluxer_api typecheck passed.
  • biome check on touched files passed.
• Manual checks:
  • Verified sso sudo re-authentication behavior across success, failure/error, and retry states.
  • Verified that non sso accounts remain completely unaffected by global SSO enforcement.
  • Verified sudo on sso-made accounts with other auth methods (totp & passkeys), allowing for SSO and local verification options.
  • Verified checkbox functionality in admin dashboard
• Screenshots or recordings:

Checklist

• I understand every change in this PR.
• I can explain what it does and why it is correct.
• I disclosed any LLM coding help below.

LLM Disclosure

Codex and Antigravity assisted with the sso sudo implementation, bug-fixing and targeting test runs. I reviewed the resulting files, edited them as needed and performed manual verification before submitting.