[enterprise-auth S3] Compose multiple auth backends with tenant-aware routing

[rickylabs]

Part of #871

Replace the one-entry runtime backend registry with a composition contract that
can route by organization, domain, connection, provider, or explicit sign-in
choice. Define account linking, session provenance, migration, global logout, and
degraded-provider behavior without allowing ambiguous identities or tenant
crossing.

Acceptance

• gate: multiple configured backends can coexist and routing is deterministic for every request
• gate: ambiguous domain/provider/account matches fail closed with an actionable diagnostic
• gate: normalized sessions retain backend, provider, organization, connection, and linked-account provenance
• gate: account linking requires verified ownership and defends against confused-deputy/account-takeover cases
• gate: logout and revocation specify local, backend, linked-account, and global scope with partial-failure reporting
• gate: migration and provider outage scenarios have model-based and integration tests
• gate: each tenant has one declared lifecycle owner for overlapping WorkOS/Better Auth features

Metadata

• Dependencies: EA-00; establishes composition used by EA-03, EA-05, EA-10, and EA-13.
• Delivery shape: new core/runtime adapter code.