Corporate Email Validation for SSO

The SSO signup experience now checks that new registrations use a supported corporate or work email domain rather than a personal one. If someone attempts to sign up through SSO using a configured personal email domain, they're now prevented from completing account creation at that point.

This email domain check happens before a user account or workspace membership is actually created, so an invalid signup is stopped early rather than needing to be cleaned up afterward. Signups using supported corporate email domains continue to work exactly as they did before, and this validation applies specifically to new SSO signups going forward, with no effect on any existing users.