SSO + public access simultaneously

Add the ability to have SSO + public portal access enabled simultaneously.

We use SSO linked to our platform, which works well for existing customers - they're automatically authenticated and can access the portal without creating a separate account. However, we also have prospects we're actively in sales conversations with who don't have a booking platform account yet, meaning they currently can't access our portal at all.

We want existing customers to continue logging in via SSO as they do today, while prospects and unauthenticated visitors can still access the portal publicly - at a minimum to browse our roadmap and get a sense of what we're building. Ideally, we'd also be able to invite specific prospects directly to the portal before they have a platform account.

Without this, we're forced to choose between a seamless SSO experience for customers and visibility for prospects, which limits how we use the portal as a sales and transparency tool.