fix(auth): enforce SSO on server-side sign-in endpoints

Resolves #5288.

- In better-auth hooks.before, reject /sign-in/email and /sign-in/social with FORBIDDEN when webServerSettings.enforceSSO is enabled
- Prevents direct API password authentication when SSO enforcement is enabled

packages/server/src/lib/auth.ts

@@ -125,6 +125,19 @@ const createBetterAuth = () =>
 					...(ctx.context.baseURL ? [new URL(ctx.context.baseURL).origin] : []),
 					...(await resolveTrustedOrigins()),
 				].filter(Boolean);
+
+				if (
+					!IS_CLOUD &&
+					(ctx.path.startsWith("/sign-in/email") ||
+						ctx.path.startsWith("/sign-in/social"))
+				) {
+					const settings = await getWebServerSettings();
+					if (settings?.enforceSSO) {
+						throw new APIError("FORBIDDEN", {
+							message: "SSO is enforced. Direct password and social sign-in are disabled.",
+						});
+					}
+				}
 			}),
 		},
 		emailVerification: {