Restrict login to members of one organization — via the Keycloak MCP server

Restrict login so only members of a specific organization can complete it, on a Phase Two hosted Keycloak, driven through the Keycloak MCP server. Use this whenever someone wants to "only let members of this org log in", "gate login by organization membership", or "restrict access to org X". Covers the p2-inc keycloak-orgs `ext-select-org` authenticator and its `match_by_org_name` setting (matching an organization by NAME vs by ID), authoring AND binding the flow in one call with `importAuthenticationFlow` (which needs the p2-inc keycloak-atomic-auth-flows extension — Keycloak's own partialImport endpoint silently ignores authentication flows entirely), and the fact that …