claims mode: enforce

SSO Demo

A throwaway relying party wired to auth.repairwise.pro with nothing but @fixlane/auth-client, six env vars, one middleware line, and three tiny routes.