#42921 chore: log in and out through SAML without Meteor's accounts runtime

Proposed changes

SAML login hung off the Meteor global (Meteor.loginWithSaml, Meteor.loginWithSamlToken), and single logout patched Meteor.logout. None of it existed in the Vite client: SAMLLoginRoute called an inert shim, and vite/native/login.ts skipped the module.

• loginWithSaml registers through registerLoginWithMethod, like CAS and LDAP.
• loginWithSamlToken is exported, and SAMLLoginRoute imports it directly.
• The identity-provider logout is logoutFromSamlIdp(). UserProvider calls it before the local logout, and it returns false when the session should only end locally. That is the same decision tree the Meteor.logout override used.
• vite/native/login.ts now loads the SAML module.
• The type augmentations that only described the removed globals (Meteor.loginWithSaml*, Accounts.saml) are gone. Accounts.onLogout and the service-configuration fields stay, because the server uses them.

Both builds now run the same SAML code.

Steps to test or reproduce

With a SAML IdP (e.g. Keycloak) configured:

1. Log in through the SAML button. You land on /home logged in. With an invite token, you land on /invite/<token>.
2. With SAML_Custom_Default_logout_behaviour set to SAML and an SLO redirect URL configured, logging out redirects through _saml/sloRedirect/....
3. With the logout behaviour set to Local, logging out only ends the Rocket.Chat session.
4. Repeat 1–3 on yarn dev:next (Vite client).

Issue(s)

ARCH-2558

Summary by CodeRabbit

• Bug Fixes

  • Improved SAML logout handling, including fallback to local logout when identity-provider logout is unavailable or unsuccessful.
  • Preserved SAML login behavior across browser and native login flows, including token handoff and navigation.

• Tests

  • Updated SAML login coverage to validate the current login flow and callback behavior.