Enterprise SSO sign-in issues

Checklist:

1. NEXT_PUBLIC_CLERK_ENTERPRISE_ENABLED=true in the frontend environment
2. User email domain is verified on the organization identity config
3. Clerk dashboard has SSO connection for that domain
4. Callback URLs include /auth/sso-callback
5. User selects Continue with SAML SSO and enters the work email (not personal email)

Post-login redirect: returnTo must match the allowlist in auth utilities. Community and VS Code flows preserve query params through SSO.

Test from Settings → Identity → Test login when available.