SSO App Launcher (identity-hub: login once, launch membered tenant apps)

[ahmetabdullahgultekin]

Future work. Design in identity-core-api/docs/SSO_APP_LAUNCHER_DESIGN.md + PHASE1_PLAN.md (kept as reference / or migrate detail here). Needs an SSO session at the AS + silent re-auth; SAML = north-star. Not built.