SSO: redeem one-time ticket on return from the hub

fitme3070.pt is off the .andmore.pt cookie scope, so am_sso never arrives
and login never provisioned the user. Redeem the ?sso_ticket=… the hub now
appends to the return URL instead.

- sso_redeem_ticket(): atomic single-use burn of sso_tickets in the central
  DB, bound to PLATFORM_SLUG, then provision the local row + FIT_SESS session.
- Extract _sso_provision_local() shared with the cookie path.
- views/auth/login.php redeems the ticket before the cookie fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

views/auth/login.php

@@ -16,10 +16,17 @@
 require __DIR__ . '/../../config/db.php';
 require_once __DIR__ . '/../../config/functions.php';
 
-// Visitor may already have an am_sso cookie — resolve it instead of bouncing
-// (saves a round-trip).
+// Establish the session on return from the hub. fitme3070.pt is off the
+// .andmore.pt cookie scope, so the real handoff is the one-time ?sso_ticket=…
+// the hub appended to this return URL — redeem it. (sso_resolve_session() is
+// kept as a fallback for the rare case a same-site am_sso cookie is present.)
 if (empty($_SESSION['user_id']) && identity_is_federated()) {
-    sso_resolve_session($pdo);
+    if (!empty($_GET['sso_ticket'])) {
+        sso_redeem_ticket($pdo, (string) $_GET['sso_ticket']);
+    }
+    if (empty($_SESSION['user_id'])) {
+        sso_resolve_session($pdo);
+    }
 }
 
 $next       = $_GET['next']       ?? '';