feat(den): support Entra SSO auto-join

[pascalandr]

Replaces #1895.

Summary:

• Adds Microsoft Entra SSO provider parsing and auto-join support.
• Preserves org membership lifecycle fields and pending invitation seat reservations.
• Normalizes Entra group identifiers and covers invite/member lifecycle edge cases.

Verification:

• pnpm --dir "ee/apps/den-api" exec tsc -p tsconfig.json --noEmit
• pnpm --dir "ee/apps/den-api" exec bun test --timeout 30000 test/entra-sso.test.ts test/org-invitations.test.ts test/org-invitation-lifecycle.test.ts
• pnpm --dir "ee/apps/den-web" exec tsc -p tsconfig.json --noEmit

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jun 12, 2026 10:59am

[vercel]

@pascalandr is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

No issues found across 17 files

_{Re-trigger cubic}