Add sso-diagnose.sh: verify all peertube-sso-incident claims into a log

- docs: record the open identity-forwarding question, auth contracts, and responsibility boundary

.gitignore

@@ -61,6 +61,9 @@ app/public/assets/dist/
 # creds-test probe log (may contain error traces — no secrets, but generated per-run)
 creds-test.log
 
+# sso-diagnose output log (generated per-run)
+sso-diagnose.log
+
 # PHPUnit
 .phpunit.result.cache
 coverage/