feat: P2.9 VNCtalk + P2.10 Collabora + P2.11 Calendar Enhancements + P2.13 VNCdirectory Admin

- P2.9: VNCtalk video meeting — create/update meeting from event modal,
  'Join Meeting' link in event detail. Admin config vnctalkServerUrl.
- P2.10: Collabora online editing — 'Edit with Collabora' for office files,
  WOPI discovery + edit URL. Admin config collaboraServerUrl.
- P2.11: Calendar enhancements — clickable links in descriptions,
  participant contact popover, Reply/Reply All from event, timezone picker,
  map links for locations.
- P2.13: VNCdirectory IDP admin panel — Connection, SAML/IDP, LDAP,
  Authentication, Federated Apps configuration. Secret masking on display.

app/api/auth/sso/start/route.ts

@@ -10,6 +10,17 @@ import { getCookieOptions } from '@/lib/oauth/cookie-config';
 import { hasSessionSecret } from '@/lib/auth/session-secret';
 import { configManager } from '@/lib/admin/config-manager';
 
+// TODO(P2.13): Wire SAML IDP integration once VNCdirectory is configured.
+// When VNCdirectory is enabled and SAML is configured (see
+// lib/admin/vncdirectory-config.ts), the SSO start flow should:
+//   1. Check isVncDirectoryEnabled() — if false, fall through to existing OAuth flow.
+//   2. Read getVncDirectoryConfig() for samlIdpUrl, samlIssuer, samlSpCert.
+//   3. Build a SAML AuthnRequest and redirect to the IdP instead of OAuth.
+//   4. The /sso/complete handler should process the SAML Response assertion,
+//      validate the signature against the SP certificate, extract the subject,
+//      and create a session.
+// Reference: docs/admin/VNCDIRECTORY.md in the VNCmail+ plan (P2.13).
+
 const SSO_PENDING_COOKIE = 'sso_pending';
 const SSO_PENDING_MAX_AGE = 300; // 5 minutes