Add multi-ingress domains to SCIM IdPs

[Copilot]

Ticket: https://wearezeta.atlassian.net/browse/WPB-20052

Adds support for associating SAML IdPs with multi-ingress domains. When multi-ingress is configured, each domain can have at most one IdP to enable deterministic SSO code resolution per email domain.

Key changes:

• Add domain field to WireIdP extra info, stored only for configured multi-ingress domains
• Add filterMultiIngressZHost to validate ZHost against configured domain mappings
• Add guardMultiIngressDuplicateDomain checks on IdP create/update to enforce one-IdP-per-domain
• Add SparIdPDomainInUse error (409) when domain constraint violated
• Add Cassandra schema update for domain column in idp table

Behavior:

• Teams without multi-ingress configured: no change, multiple IdPs allowed
• Teams with multi-ingress: bijective mapping (domain, team) → IdP enforced at API level
• IdPs created on unconfigured domains store no domain field (guards against later multi-ingress config conflicts)

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.