azure-ad-sso-deferred-local-auth-v1-because-runwal-ad-incomplete

R-Same v1 uses local auth (argon2id + TOTP + JWT httpOnly cookies) rather than Azure AD SSO because Runwal’s Azure AD configuration is not yet complete. Stub interfaces for Azure AD OIDC/SAML2 are included in v1 code for forward-compatibility. Migration path: dual-mode login → per-user email-match → deprecate local. Do not re-enable Azure AD SSO until the Runwal AD work is confirmed done.