wmantly
1e38ef8dc5
The per-host "Allowed groups" field suggested only local groups, permission subjects and conf.auth maps. None of those can ever match an SSO-gated host: its allow-list is checked against the `groups` claim the SSO issues (utils/host_sso.js), so only SSO groups are candidates. Adds a conf.sso block (url + read-only apiToken, minted by theta-suite's bootstrap) and a cached /api/group lookup merged into the suggestions. Degrades silently to the previous local-only list when unset, and never fails the request. Authenticates with `Authorization: Bearer <token>` -- the SSO's `auth-token` header is for browser session UUIDs and rejects a minted API token. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>