fix(auth): remove sign-in discovery rate limits

[pandemicsyn]

Summary

• Remove the IP and normalized-email Vercel Firewall checks added to /api/sso/organizations by feat(auth): add email-first sign-in #5453.
• Prevent legitimate email-first and SSO sign-ins from receiving discovery 429 responses.
• Retain Turnstile verification before provider or SSO discovery, along with existing magic-link and account-creation rate limits.

Verification

• Not manually tested against production because this change must be deployed before production can exercise the updated route. The focused route suite covers normal discovery and confirms Turnstile remains required.

Visual Changes

N/A

Reviewer Notes

Production telemetry showed legitimate discovery requests receiving 429 responses after the new sign-in-discovery-ip and sign-in-discovery-email policies were enabled. This removes only those two discovery limits; the pre-existing magic-link-email limit, signup IP limits, and Turnstile gate remain unchanged.

After deployment, the two now-unused Vercel Firewall rules can be removed.

Automated checks run locally:

• pnpm --filter web test apps/web/src/app/api/sso/organizations/route.test.ts --runInBand (14 tests)
• pnpm --filter web typecheck
• pnpm --filter web lint
• git diff --check

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/app/api/sso/organizations/route.ts
• apps/web/src/app/api/sso/organizations/route.test.ts

Previous Review Summary (commit 45b260f)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 45b260f)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/app/api/sso/organizations/route.ts
• apps/web/src/app/api/sso/organizations/route.test.ts

---

_{Reviewed by grok-4.6 · Input: 38K · Output: 4.8K · Cached: 190.5K}

_{Review guidance: REVIEW.md from base branch main}