saml: e2e verification against a real Slack workspace

End-to-end validation of the SAML IdP against a test Slack workspace.

Surfaced by the saml-idp plan's closeout (PR #49). The plan's unit tests cover:
- metadata XML structure
- IdP-initiated POST form structure + signed assertion contents
- SP-initiated AuthnRequest handling + resume cookie flow

But these don't exercise the real Slack SP behaviour. The validation needs:

1. Connect a test Slack workspace (or codeforphilly.slack.com staging) to our IdP using the generated metadata
2. IdP-initiated: hit `/api/saml/slack/launch?channel=phlask` while signed in — verify Slack signs the user in and lands them in #phlask
3. SP-initiated: sign into Slack via "Sign in with SSO" — verify the AuthnRequest round-trip works end-to-end
4. Anonymous SP-initiated: same as (3) but starting from a signed-out browser — verify the resume cookie survives the /login redirect

Requires:
- Test Slack workspace (or staging admin access on codeforphilly.slack.com)
- Deploy to a publicly-reachable URL so Slack can POST to /api/saml/slack/sso

Out of band of the v1 cutover release.

Empieza con el cierre del plan saml-idp y su cobertura de pruebas unitarias existente, y después prepara un espacio de trabajo de prueba de Slack y un despliegue accesible públicamente. Prueba /api/saml/slack/launch?channel=phlask, el flujo de Slack “Sign in with SSO” y el flujo de la cookie de reanudación para usuarios sin sesión iniciada a través de /api/saml/slack/sso. Se considera completado cuando los tres escenarios reales de Slack finalicen correctamente.

Escrito por el modelo de indexación a partir del texto del issue.