SSO account linking, live execution progress, and global search

Identity now resolves by IdP subject instead of email, running executions stream real-time status, and search now reaches across the whole platform.

SSO account linking got a full rework: identity now resolves by IdP subject instead of silently matching on email, with an explicit user-facing link flow, enforced email verification, and an admin path to reconnect a user after their IdP subject rotates.

Running executions now stream live progress — a human-readable, step-by-step status with per-tool icons, generated deterministically with no LLM call or added cost. And a new global search reaches across both Studio and Hub, backed by trigram indexes on Postgres.

Also in this release:

A superadmin audit log for administrative actions, and execution visibility now scoped to the run's owner
Built-in system tools usable directly inside TOOL nodes, no MCP server required
Cross-node agent memory: sub-agent results are captured so later steps in the same run can recall them
Conversations now name themselves from the first exchange, and Excel execution exports gain Input/Output columns

Truncated LLM output is now recovered instead of being treated as malformed, and a timezone picker backed by a real timezone enum replaces manual offsets on schedules.