SSO Tests 🔐

Integration tests that enforce per-role invariants of the unified services.sso block across roles, including normalization of allowed_groups paths and allocation of per-consumer SSO-proxy ports.

Tests in this directory MUST only cover SSO configuration invariants. Generic port-uniqueness and port-reference-validity rules MUST live under tests/integration/ports/, and domain-related checks MUST live under tests/integration/domains/.

For framework, directory layout, and make test-integration usage see integration.md.