🔒 Auth Clerk (pluggable provider)

[PierreBrisorgueil]

Managed auth provider (SSO, MFA). Trigger: SSO/MFA demand

Source: Dashboard — Todo.md (Later)

Sub-issue of Auth & session hardening (#3804).