preliminary auth review 2

[jumpy-cat]

Authentication:

• Add SAML strategy (src/auth/saml.ts) to authenticate users via UMich Shibboleth, supporting both test and production IdP endpoints. SAML disables gracefully if certificate files are missing so the server can still start in development.
• Add auth routes (src/routes/auth.ts) for login redirect, SAML callback, logout with Single Logout, session introspection (/me), and SP metadata serving for IdP registration.
• Back sessions with MongoDB via connect-mongo so sessions survive server restarts and are production-ready. Cookies are httpOnly, secure in production, and sameSite=lax.

Middleware:

• Add requireAuth to gate user-specific endpoints behind a valid Shibboleth session, returning 401 for unauthenticated requests.
• Add requireAdmin to gate future usage-data endpoints behind an "admin" role check on InternalAccount, returning 403 for non-admins. This replaces the separate DevAccount model — admin users log in via Shibboleth like everyone else and are promoted in MongoDB.

User data routes:

• Rewrite all CRUD endpoints to use implicit ownership (Approach A): no :accountId in URLs, all queries scoped to req.user.accountId. This eliminates authorization bypass bugs where a missing ownership check could expose another user's data.
• Remove POST /account since accounts are auto-provisioned on first SAML login via upsert in the verify callback.
• Validate all write request bodies with Zod schemas.

Cleanup:

• Remove DevAccount model, dev routes, and requireDev middleware. Admin access is handled by the roles array on InternalAccount.
• Remove JWT_SECRET and DEV_ADMIN_KEY from .env_example.
• Add SAML and session environment variables to .env_example with setup instructions for certificate files.