A dashboard user's Cognito sign-in links, for CFX operators offboarding a
deleted SSO connection. Records no activity, which admin-dashboard records;
publishes auth.dashboardUser.passwordSignInRestored when it unlinks any.
Unlinks every identity whose IdP is neither Google nor an ACTIVE
connection's, then signs the user out everywhere, even after a partial
unlink. Refused while their domain has ACTIVE SSO.
A dashboard user's Cognito sign-in links, for CFX operators offboarding a deleted SSO connection. Records no activity, which admin-dashboard records; publishes
auth.dashboardUser.passwordSignInRestoredwhen it unlinks any.