Fleet Desktop SSO: device SSO endpoints and session plumbing

[juan-fdz-hawa]

Related user story

#47116

Task

Ships the device SSO SAML flow, inert: a new device-token-authenticated initiation endpoint, a fleet_desktop initiator branch on the existing MDM SSO callback, and a Redis-backed device SSO session store with its __Host- cookie. Nothing consumes the session yet - enforcement is sub-issue 3 - so this merges with zero behavior change and is independently integration-testable.

Condition of satisfaction

Initiation:

• With premium + IdP configured + sso_enabled: true: POST /device/{token}/sso returns an IdP URL whose SAMLRequest resolves against the configured metadata, and sets the __Host-FLEETSSOSESSIONID handshake cookie.
• With sso_enabled: false → client error (not 500). With no IdP configured → client error naming end user authentication. Free tier → ErrMissingLicense shape (402/paymentRequired per existing convention).
• Invalid device token → 401, identical to other device endpoints.

Callback:

• A SAML assertion for a fleet_desktop-initiated session responds 303 to the device page URL, sets the device SSO session cookie, and deletes the handshake cookie.
• The minted session maps to the initiating host (HostID/HostUUID match) and expires after the configured TTL (test with a short TTL).
• Existing initiators (ota_enroll, setup_experience, account_driven_enroll, mdm_sso) behave byte-for-byte as before — their integration tests pass unchanged.
• The fleet_desktop branch never writes host↔IdP-account associations (assert AssociateHostMDMIdPAccountDB-related mock not invoked for this initiator).

No enforcement yet:

• With sso_enabled: true and no session cookie, all other device endpoints still respond 200 (the gate is sub-issue 3) — pin this with a test that sub-issue 3 will flip.

Tests/commands:

• MYSQL_TEST=1 REDIS_TEST=1 go test -run TestIntegrationsMDM ./server/service/... (or the suite hosting the MDM SSO callback tests) extended with the fleet_desktop initiator cases.
• MYSQL_TEST=1 REDIS_TEST=1 go test ./ee/server/service/...
• go test ./server/sso/... if the session store lands there.
• make lint-go-incremental clean; make generate-mock if the datastore/service interfaces changed.
• Add a changes/ changelog entry if this PR alters user-visible behavior (likely not — the flow is inert until the gate ships; the story-level entry can land with sub-issue 3).