Upgrade @fastify/passport 3.0.2 → 4.0.0

# Upgrade @fastify/passport 3.0.2 → 4.0.0 (major)

Dependabot opened a major bump of `@fastify/passport` (`^3.0.2` → `^4.0.0`). Runtime auth dependency used in `forge/ee/routes/sso/auth.js`. Pulled out of the weekly Dependabot slot per the major-version process — needs an owner and end-to-end verification, not a batch merge.

## Compatibility pre-check (all pass)

- `fastify-plugin ^6.0.0` peer — have 6.0.0 ✅
- `@fastify/flash ^6.0.0` peer — have 6.0.3 ✅
- fastify 5.x — on 5.10.0 ✅
- got → native `fetch` removal — Node 24 covers it ✅
- `openid-client` 6.x — not installed, OIDC-via-openid-client path unused ✅

Clean peer resolution suggests a small migration, but the auth path still gets verified.

## To do before merge

- [ ] Verify SSO **login and logout** end-to-end, ideally multi-instance — #1394 changed multi-instance session data handling on login/logout.
- [ ] Confirm `typecheck` passes — 4.0.0 ships type defs emitted with TypeScript 6 (declared breaking change); repo is on TS 5.9.3.
- [ ] Check strategy registration against the `isMultiStrategy` fix (behavior change when an array of strategies is provided).
- [ ] Read the 4.0.0 changelog / migration notes and reconcile with `auth.js` usage.

## Refs

- Branch: `dependabot/npm_and_yarn/fastify/passport-4.0.0`
- Upstream: https://github.com/fastify/fastify-passport/releases/tag/v4.0.0

Start with forge/ee/routes/sso/auth.js on branch dependabot/npm_and_yarn/fastify/passport-4.0.0, then read the @fastify/passport 4.0.0 changelog and migration notes. Run the repository typecheck and verify SSO login and logout, ideally across multiple instances; check strategy registration and reconcile any findings with the auth.js usage.

Written by the indexing model from the issue text.