Merge commit from fork

* fix(sso): bind domain verification to provider state

Complete domain verification with an atomic guarded transition keyed by the provider row, exact domain snapshot, and unverified state. Concurrent provider mutations now return a retryable conflict instead of applying stale DNS proof.

Document the conflict behavior and cover provider mutation, replacement, deletion, simultaneous verification, memory-adapter, and downstream trust cases.

* fix(sso): allow domain verification when the stored bit is null

* test(sso): assert the resolved DNS hostname outside the mock callback

* fix(sso): require verified domains for organization assignment

Use verified persisted provider domains and canonical verified user emails for domain-derived routing and organization membership. Keep explicit organization-bound SSO provisioning separate from domain trust.

* fix(sso): scope domain verification to organization assignment

* fix(sso): keep verified provider lookup internal

---------

Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>