fase(25-26): keyboard shortcuts, mobile responsive, enterprise SSO/audit

- Phase 25.4: N shortcut for new exploration on dashboard (react-hotkeys-hook)
- Phase 25.5: overflow-x-auto on tables, responsive padding (p-4 md:p-6)
- Phase 26: SAML/OIDC/LDAP providers (build-fixed), TOTP/MFA service
- Phase 26: KyselySSOConfigRepository + KyselyTOTPRepository
- Phase 26: SSO HTTP controller (config CRUD + MFA setup/verify/disable)
- Phase 26: Audit module index.ts + SSO module index.ts
- Phase 26: Session management endpoints (findByUserId, deleteById, list/revoke)
- Phase 26: SSO and audit routes feature-gated (auth:sso, audit:logs)
- Phase 26: Frontend SSOSection (SAML/OIDC/LDAP config + TOTP setup)
- Phase 26: Frontend SessionsSection (list/revoke active sessions)
- Phase 26: Settings navigation updated with SSO & Sessions sections

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dist/modules/sso/infrastructure/providers/SAMLProvider.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAMLProvider = void 0;
+/**
+ * SAML 2.0 SSO provider.
+ * Uses @node-saml/node-saml for SP-initiated SSO.
+ */
+const node_saml_1 = require("@node-saml/node-saml");
+class SAMLProvider {
+    constructor(config) {
+        const samlConfig = {
+            entryPoint: config.entryPoint,
+            issuer: config.issuer,
+            idpCert: config.cert,
+            callbackUrl: config.callbackUrl,
+            wantAuthnResponseSigned: false,
+        };
+        this.saml = new node_saml_1.SAML(samlConfig);
+    }
+    async generateAuthUrl(relayState) {
+        return this.saml.getAuthorizeUrlAsync(relayState ?? '', undefined, {});
+    }
+    async validateResponse(body) {
+        const { profile } = await this.saml.validatePostResponseAsync(body);
+        if (!profile) {
+            throw new Error('SAML validation failed: no profile');
+        }
+        return {
+            nameID: typeof profile.nameID === 'string' ? profile.nameID : '',
+            email: typeof profile['email'] === 'string' ? profile['email'] : undefined,
+            displayName: typeof profile.displayName === 'string' ? profile.displayName : undefined,
+        };
+    }
+}
+exports.SAMLProvider = SAMLProvider;