docs(enterprise): align Authentik SAML setup with managed profile mappings

[rajshah4]

Authentik's default Email property mapping emits a URI-named attribute, while the managed OpenHands SAML profile importers read the simple attributes email, firstName and lastName. Document an explicit email mapping and optional structured name mappings so administrators can configure the intended profile contract. This is a source-verified documentation mismatch; this PR does not claim a newly reproduced live login failure.

Also clarify the default realm versus managed broker alias, restrict application access before rollout, use an employee identity for verification, and link the shared sign-in, repository, offboarding and certificate-renewal guidance. Keep IdP eligibility separate from OpenHands memberships, repository grants, corporate-only policy and credential revocation.

Dependencies and Publication Gates

• Stacked on docs PR965 for the shared lifecycle sections. After PR965 merges, retarget to main and confirm the diff contains only Authentik changes.
• Keep draft until the release containing OpenHands/OpenHands-Cloud PR1422 and PR1423 is identified and the managed customer setup is qualified for the deployment paths being advertised. Do not infer standalone Helm acceptance from Replicated testing.
• Validate a fresh Authentik user's claims, profile, repeat account/history and intended application bindings on that release. Refresh affected screenshots and review the Mintlify preview before publication.
• No minimum fixed version, automatic profile synchronization, SCIM, group-to-role synchronization, complete offboarding or corporate-only enforcement is promised.

Related tracking: OHE-3617 and OHE-3626. No new implementation issue is requested.

Validation

• Authentik MDX syntax compilation and whitespace checks passed locally.
• New shared lifecycle links resolve against the edited PR965 guide; they are not available on current main.
• Source inspection verified the attribute-name mismatch and managed IMPORT behavior. No live Authentik deployment, certificate rotation, session-revocation acceptance or updated screenshot validation was performed for this change.

Source Verification

• Authentik default property mappings: https://github.com/goauthentik/authentik/blob/47e88fe32b0c2ab2a294adf604cf48fa680618f9/blueprints/system/providers-saml.yaml#L15-L38
• Managed OpenHands simple attribute importers: https://github.com/OpenHands/OpenHands-Cloud/blob/4d8561e1d413f2d7a6b0782c4a50085bf5e2afc1/charts/openhands/templates/keycloak-config-script.yaml#L461-L488
• Keycloak attribute-name selection and profile mapping: https://github.com/keycloak/keycloak/blob/88d87bcf4b4e70b36fc774ffbe84225db8deb233/services/src/main/java/org/keycloak/broker/saml/mappers/UserAttributeMapper.java#L137-L163
• Managed realm provisioning: https://github.com/OpenHands/OpenHands-Cloud/blob/d5e61fcf349d4ca2472cafdb0d44a7b41effda52/charts/openhands/templates/_keycloak.yaml#L1-L19
• Separate organization bootstrap controls: https://github.com/OpenHands/OpenHands-Cloud/blob/4d8561e1d413f2d7a6b0782c4a50085bf5e2afc1/replicated/config.yaml#L784-L801

[ak684]

Holding (stacked on #965, gated on the release). Before taking this out of draft:

1. After docs(enterprise): clarify generic SAML setup and access management #965 merges, retarget to main; no Mintlify preview has run on this PR yet.
2. Keycloak requests the first NameID format in the imported metadata, which may not be the Persistent policy set in Authentik. Verify on a live Authentik and state the format actually used.
3. Refresh the property-mapping screenshot; it still shows only the defaults.