c98214cc76
- Default the "Parent Wildcard" challenge type when a wildcard parent exists. - Split Authentication (basic auth + SSO) into its own tab; Access keeps IP allow/deny. - Add GET /api/host/auth-suggestions (authenticated host editors, not just admins) and datalist-backed "type to search + Add" pickers for the SSO allowed-users/groups lists. Verified in a browser (tab present, datalist populated, picker appends deduped). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>