Enforce Non-Bypassable SSO with Optional Break-Glass Account

Add a per-account setting that enforces SSO without bypass, even for Admins and Super-Admins. This would make SSO a true security requirement.