Sign up by clicking a provider button

When the SSO callback returns a profile that does not match any existing user, create a new account from the profile. The new account is linked to the provider that signed them in.

Constraints

Accounts.register_user/1 runs a changeset that requires password and terms_accepted. Per the wireframes (see the design check-in on #4621), after the callback the user lands at Your Role and Your Organisation, skipping Your Information and Set up a password. So this isn't a one-shot create-on-callback. Two shapes worth weighing:

• Create the user at callback time with a register_sso_user/1 path that skips password and lets the wizard fill the rest in.
• Stage the IdP profile in the session and create the user only after the wizard completes.

Decision belongs in this ticket before implementation starts. Either way, terms acceptance has to land somewhere in the wizard.

New SSO accounts must be created with confirmed_at set. The IdP has verified the email, and without it the account confirmation modal traps the user after 48 hours under :require_email_verification.

Depends on #4692.