feat(auth): Add organization authentication card (#122335)

Adds the organization-authentication card shown after slug lookup. It
distinguishes required, optional, and unavailable SSO; submits provider
login through the existing CSRF-protected browser POST flow; and exposes
join-request and clear-context actions when available.

Provider branding uses the generalized inline `IdentityIcon` from the
preceding prerequisite PR.