docs: add domain verification for org sso

[awxxxxxx]

Summary

• Add domain verification steps for OIDC and SAML in Organization SSO Authentication.
• Clarify that OIDC/SAML Allowed Email Domains are required and must use verified domains.
• Update auto-provision guidance to avoid implying allowed domains are only recommended for OIDC/SAML.

Tests

• ./scripts/markdownlint tidb-cloud/tidb-cloud-org-sso-authentication.md
• npx remark tidb-cloud/tidb-cloud-org-sso-authentication.md

[gemini-code-assist]

Code Review

This pull request updates the TiDB Cloud Organization SSO authentication documentation by adding a new section on adding and verifying domains for OIDC and SAML, and clarifying that configuring allowed email domains is required for these methods. The review feedback focuses on improving clarity, conciseness, and style-guide compliance. Key suggestions include rephrasing passive voice to active voice, simplifying wordy phrasing (such as changing 'according to your need' to 'as needed'), and correcting unidiomatic prepositions (such as changing 'locked out by' to 'locked out of').

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The sentence "Only domains with the Verified status can be used..." uses passive voice. Rephrasing it to active voice using the second person ("you") makes it more direct and easier to read.

Suggested change

	Before configuring OIDC or SAML, add and verify the email domains that your organization members use to sign in. Only domains with the **Verified** status can be used in **Allowed Email Domains** for OIDC and SAML.
	Before configuring OIDC or SAML, add and verify the email domains that your organization members use to sign in. You can only use domains with the **Verified** status in the **Allowed Email Domains** field for OIDC and SAML.

References

1. Avoid passive voice overuse and write in second person ('you') when addressing users. ^(link)

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from qiancai. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment