feat(enterprise): Phase 14 — API Key Management + SSO/SAML 2.0

- ApiKey model (SHA-256 hash, prefix, scopes, expiry) + Alembic migration (b040ent)
- SsoConfig model for SAML 2.0 IdP settings (attribute mapping, auto-provision)
- API key auth integrated into get_current_user (aegis_ prefix detection)
- Routers: /api/v1/api-keys (full CRUD + revoke) and /api/v1/sso (metadata, login, callback, config)
- python3-saml added to requirements; Dockerfile adds libxmlsec1-dev for SAML XML signing
- QA script: 52 assertions covering key lifecycle, API key auth, SSO config

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/models/__init__.py

@@ -41,6 +41,8 @@ from app.models.attack_path import (
 from app.models.knowledge import Playbook, PlaybookVersion, LessonLearned
 from app.models.risk_intelligence import TechniqueRiskProfile
 from app.models.executive_dashboard import PostureSnapshot
+from app.models.api_key import ApiKey
+from app.models.sso_config import SsoConfig
 
 __all__ = [
     "User", "Technique", "Test", "TestTemplate", "Evidence",
@@ -65,4 +67,6 @@ __all__ = [
     "Playbook", "PlaybookVersion", "LessonLearned",
     "TechniqueRiskProfile",
     "PostureSnapshot",
+    "ApiKey",
+    "SsoConfig",
 ]