SSO login flow requires redundant email input before IdP redirect

Summary The current SSO login flow requires users to enter their email address in the Vaultwarden web vault before being redirected to the external identity provider (e.g., Keycloak). This is confusing and creates unnecessary friction. Current Flow 1. User visits vault.example.com 2. User must enter their email address in the Vaultwarden login form 3. Vaultwarden redirects user to Keycloak 4. User enters their username and password in Keycloak 5. Keycloak redirects back to Vaultwarden Problem Step 2 is redundant and confusing: • The email entered in Vaultwarden is not used to authenticate — Keycloak handles that entirely • Users don't understand why they need to enter an email before being sent to their SSO provider • Organizations using SSO-only mode (SSO_ONLY=true) have no reason to collect an email first — the IdP owns the identity • Most SSO implementations (Google Workspace, Okta, Azure AD) go directly to the IdP with a single button click, with …