fix(chat): close SSO auth bypass via checkSSOAccess body flag (#4408)

* fix(chat): close SSO auth bypass via checkSSOAccess body flag

- Remove checkSSOAccess short-circuit; SSO branch always validates via getSession()
- Skip chat_auth cookie issuance/validation for SSO deployments to prevent replay
- Split eligibility pre-flight into dedicated POST /api/chat/[identifier]/sso route
- Drop .passthrough() and checkSSOAccess from deployed chat contracts
- Add SSO branch test coverage in chat utils

* fix(chat): cast allowedEmails to string[] for SSO eligibility check

* fix(chat): close SSO GET cookie replay and add eligibility rate limit

- Skip chat_auth cookie validation for SSO in GET handler (replay vector for pre-fix cookies)
- Route SSO GET through getSession() instead of always returning auth_required_sso so post-IdP config fetch works
- Add per-IP rate limiting to /api/chat/[identifier]/sso to prevent allowlist enumeration

scripts/check-api-validation-contracts.ts

@@ -9,8 +9,8 @@ const QUERY_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/queries')
 const SELECTOR_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/selectors')
 
 const BASELINE = {
-  totalRoutes: 717,
-  zodRoutes: 717,
+  totalRoutes: 718,
+  zodRoutes: 718,
   nonZodRoutes: 0,
 } as const