docs(saml): either signing level, email fallbacks, account carry-over, rotation

[eseidel]

The SAML guide told customers to configure around limitations the auth service no longer has, and stated a few of them as requirements. This removes those and leaves only the places where Shorebird is non-standard. The page says what to do, not what changed.

Merge after the two still-open auth PRs whose behaviour it now assumes — existing-account carry-over (shorebirdtech/_shorebird#2840) and metadata re-import (shorebirdtech/_shorebird#2847) — have landed.

Removed, because standard SAML now just works

• "Shorebird requires both the response and the assertion to be signed" and the two Signed (RSA-SHA256) rows. Either level is accepted; every provider's default works.
• "The email attribute is required … sign-in fails without one of them, even when the Name ID is the email address." Okta's and Entra's defaults are read as-is.
• "Mention any members who already have a Shorebird account … those accounts need to be migrated … their first SSO sign-in fails." First SSO sign-in carries the account over.

Kept or added, because Shorebird is non-standard there

• Assertion encryption must be off — new row. No decryption key is configured, so an IdP with encryption on fails; this was true before and undocumented.
• Signed authentication requests must not be required — unchanged.
• Identity is keyed by email — retitled section. A Persistent/Transient Name ID is opaque and needs an email attribute alongside it; the attribute table stays for that case and for the Okta walkthrough.
• Metadata is not re-read automatically — the rotation section now leads with that, since it is the one thing a customer has to act on: a certificate that was listed at the last read needs nothing, one generated since needs an email.

Troubleshooting's "SSO login failed" row no longer leads with a missing email attribute.

Prettier-formatted (proseWrap: always).

https://claude.ai/code/session_01Ks1X8BmfFzfJRm7nXJa7Vc