Add sso-diagnose.sh: verify all peertube-sso-incident claims into a log

- docs: record the open identity-forwarding question, auth contracts, and responsibility boundary

justfile

@@ -580,6 +580,13 @@ app-token:
     #   --instance https://videos.erg.be --client <id> --secret <secret>
     @bash scripts/app-token.sh
 
+[group('utils')]
+sso-diagnose:
+    # Verify every claim in docs/peertube-sso-incident.md (DNS, IdP discovery,
+    # PeerTube OAuth, SMTP AUTH, header propagation) and append to sso-diagnose.log.
+    #   --instance <url> --idp <host> --smtp <host:port> --db <path> --log <path>
+    @bash scripts/sso-diagnose.sh
+
 [group('utils')]
 clean:
     @rm -f app/error.log