saml: e2e verification against a real Slack workspace

End-to-end validation of the SAML IdP against a test Slack workspace.

Surfaced by the saml-idp plan's closeout (PR #49). The plan's unit tests cover:
- metadata XML structure
- IdP-initiated POST form structure + signed assertion contents
- SP-initiated AuthnRequest handling + resume cookie flow

But these don't exercise the real Slack SP behaviour. The validation needs:

1. Connect a test Slack workspace (or codeforphilly.slack.com staging) to our IdP using the generated metadata
2. IdP-initiated: hit `/api/saml/slack/launch?channel=phlask` while signed in — verify Slack signs the user in and lands them in #phlask
3. SP-initiated: sign into Slack via "Sign in with SSO" — verify the AuthnRequest round-trip works end-to-end
4. Anonymous SP-initiated: same as (3) but starting from a signed-out browser — verify the resume cookie survives the /login redirect

Requires:
- Test Slack workspace (or staging admin access on codeforphilly.slack.com)
- Deploy to a publicly-reachable URL so Slack can POST to /api/saml/slack/sso

Out of band of the v1 cutover release.

先完成 saml-idp 计划的收尾工作及其现有的单元测试覆盖，然后设置一个 Slack 测试工作区和一个可公开访问的部署。测试 /api/saml/slack/launch?channel=phlask、Slack 的“Sign in with SSO”流程，以及通过 /api/saml/slack/sso 实现的已登出状态下的 resume-cookie 流程。三个真实的 Slack 场景都成功完成即表示完成。

由索引模型根据 Issue 内容生成。