docs(sso): role and team mapping with new-member-only defaults

[alick-liming]

Summary

• Document OIDC/SAML/CAS role and team name mappings, multi-select defaults, exact matching, and smallest-ID selection for duplicate names.
• Emphasize leaving default roles/teams empty in most cases: defaults are shared by all unmatched members newly created through this SSO configuration.
• Explain that defaults apply only during actual JIT member creation; existing/invited members keep unmatched assignments. Valid mappings still replace assignments independently.
• Keep the LDAP section and unrelated documentation unchanged; Chinese and English are aligned.

Validation

• mint broken-links: passed, no broken links.
• mint validate: build validation passed.
• git diff --check and independent full-branch review: passed.

Scope / Notes

• Based on main d9f1496; targets a dedicated feat integration branch, not main.
• Publish together with the backend new-member-only defaults follow-up to fc-pgy #913.