TalentAI & Enterprise HCM Now Enforce Live ZITADEL Source-Session Verification

To eliminate session revocation lag across product subdomains after website sign-out or account disablement, the official site now serves `/api/product-sso/session-check`: - Every SSO handoff issues an audience-bound `source_proof` capped at the source session TTL (max 1 hour); - Product backends verify both `SessionRevocation` and live ZITADEL account activity; - Temporary upstream hiccups fail closed without erasing browser cookies, preserving both security and session resilience.