feat: add tenant SSO context surface

[Zetazzz]

Summary

• Add the SSO request-context surface and request-level loaders.
• Carry trusted siteId through routing, API structure, Express Context, pgSettings, and Graphile.
• Resolve Tenant-scoped identity-provider configuration and internal secrets through the existing context loader lifecycle.

Stack

Base: #1704
Next: #1706

Validation

• express-context tests: 33 passed at this layer
• routing tests: 12 passed
• affected package builds passed