saml: e2e verification against a real Slack workspace

End-to-end validation of the SAML IdP against a test Slack workspace.

Surfaced by the saml-idp plan's closeout (PR #49). The plan's unit tests cover:
- metadata XML structure
- IdP-initiated POST form structure + signed assertion contents
- SP-initiated AuthnRequest handling + resume cookie flow

But these don't exercise the real Slack SP behaviour. The validation needs:

1. Connect a test Slack workspace (or codeforphilly.slack.com staging) to our IdP using the generated metadata
2. IdP-initiated: hit `/api/saml/slack/launch?channel=phlask` while signed in — verify Slack signs the user in and lands them in #phlask
3. SP-initiated: sign into Slack via "Sign in with SSO" — verify the AuthnRequest round-trip works end-to-end
4. Anonymous SP-initiated: same as (3) but starting from a signed-out browser — verify the resume cookie survives the /login redirect

Requires:
- Test Slack workspace (or staging admin access on codeforphilly.slack.com)
- Deploy to a publicly-reachable URL so Slack can POST to /api/saml/slack/sso

Out of band of the v1 cutover release.

Start with the saml-idp plan closeout and its existing unit-test coverage, then arrange a test Slack workspace and a publicly reachable deployment. Exercise /api/saml/slack/launch?channel=phlask, Slack's “Sign in with SSO” flow, and the signed-out resume-cookie flow through /api/saml/slack/sso. Done means all three real Slack scenarios complete successfully.

Written by the indexing model from the issue text.