Add organization-level exclusive signin for SSO

Currently, Enable exclusive signin is an application setting.

When a user signs in again through the same application, Casdoor invalidates that user's existing sessions and OAuth tokens in that application. Sessions and tokens created through other applications stay active.

That is the right default when applications have independent session lifecycles. In an SSO deployment, though, the IdP session is shared: one browser cookie is reused across applications. Operators then want a different policy: a user should only be signed in from one browser at a time, for the whole organization.

#5746 already describes this gap and proposes a more general feature: turn exclusive signin into a configurable concurrent-session limit N, with both application-level and cross-application scopes. That is the right long-term design, but it is a different product change. It would replace or wrap the existing boolean, add a limit and an eviction rule (e.g. drop the oldest session), and needs a scope selector. Folding a boolean org-wide policy into that issue would either ship an incomplete N API or close #5746 without actually delivering it.

This issue is the smaller, orthogonal piece that SSO deployments usually need first:

• Keep application Enable exclusive signin as it is.
• Add the same flag on the organization. When it is on, a user may have only one active browser session across all applications. Signing in from another browser ends the previous IdP session and the OAuth tokens minted under it.
• Signing into a second application in the same browser is still SSO: it is the same session, so it must not kick the first application.
• The policy comes from the user's organization, not from the application's. A shared application in built-in should not impose built-in's exclusive-signin setting on users of another org.
• Default remains off, so existing deployments do not change.

This does not implement a session count, oldest-session eviction, or a scope selector. Those stay in #5746. Organization exclusive signin is the N = 1 cross-application case as a first-class org setting, next to options such as Disable signin, without generalizing the application flag.

Password grant, client credentials and other tokens that are not bound to a browser session are out of scope, same as today.