spike: ADR + plan for SAML federation at canopy app layer

Scope

Decide whether and how canopy should terminate SAML 2.0 directly at the application layer (vs. brokering via the OIDC IdP per Stage 4's CRAIG-aligned design).

Background

Stage 4 (#493 (closed)/#494 (closed)) ratifies canopy as an OIDC-only app. SAML brokering happens upstream (Keycloak / authentik / ZITADEL federate SAML downstream). Adding samael-based AuthnRequest + AuthnResponse validation at the canopy-web layer is multi-week scope and may never be needed for any real deployment.

Acceptance

• ADR drafted that either ratifies "OIDC-only forever" OR adopts SAML termination with a concrete deployment trigger
• Plan filed for implementation if ADR direction is "adopt SAML"
• Decision and ADR cross-referenced from docs/modules/ROOT/pages/idp-integration.adoc

References

• Tracking: epic &51 #460
• Stage 4 plan: docs/modules/ROOT/pages/plans/worker-portal-redesign-stage4-idp-loader-and-sign-in.adoc
• CRAIG IdP pattern: see ~/code/craig/docs/modules/ROOT/pages/idp-integration.adoc