feat: multi-jurisdiction sign-in (worker picks jurisdiction before email discovery)

Scope

Allow canopy-web to serve multiple jurisdictions from one deployment. Worker selects jurisdiction (state) before the email-discovery affordance.

Background

canopy-web is single-jurisdiction today (WebConfig::jurisdiction at services/canopy-web/src/config.rs:10). Stage 4 reads <rulesets_dir>/<jurisdiction>/idp.toml and doesn't surface jurisdiction as a UI affordance.

Acceptance

• Worker selects jurisdiction before email discovery (or jurisdiction is inferred from email domain at a higher level)
• Per-jurisdiction IdpRuntime instances; routing layer picks the right one
• Session carries jurisdiction field so subsequent requests don't re-prompt
• CHANGELOG entry

References

• Tracking: epic &51 #460
• Stage 4 plan: docs/modules/ROOT/pages/plans/worker-portal-redesign-stage4-idp-loader-and-sign-in.adoc