Default organization flow for `SSO_ONLY`

I would like to discuss an opt-in flow for SSO_ONLY=true where SSO users can be automatically invited or provisioned into a pre-existing default organization. Current behavior Today, SSO authentication works, but organization membership is still separate and manual. In practice, the flow is: 1. Create a local Vaultwarden user first 2. Use that user to create the first organization 3. Invite the first SSO user by email 4. Accept/confirm the invite 5. Repeat invites for future SSO users References: • The SSO wiki documents account association and invited stub accounts, but not default org auto-join: • Discussion #6192 explicitly states that auto-joining organizations is not supported: • Issue #6374 shows related onboarding friction around SSO and associated organizations: Code context From the current codebase: • create_organization() creates the organization, the creator membership, and the initial collection, but doe…