Pin three store invariants that no backend was checking

[juicycleff]

Three invariants in the older store_* conformance family have no counterpart in ssftest/ssotest, so they only ever ran on memory and sqlite. This moves them into the suites that already run all four backends.

History of this PR, since it changed shape

It originally added Postgres runners to plugins/sharedsignals/store_conformance_test.go and plugins/sso/store_conformance_test.go, on the belief that neither plugin had Postgres coverage. That was wrong. Both have a second, newer suite that already runs memory, sqlite, postgres and mongo:

plugins/sharedsignals/conformance_test.go + ssftest/
plugins/sso/conformance_test.go + ssotest/

I had surveyed a checkout 300 commits behind main, where those files did not exist. Adding a second Postgres runner alongside them would have meant two suites per plugin covering the same constraints with two fixture sets to keep in step, so that approach is dropped entirely.

Comparing the two families case by name, three cases are genuinely uncovered. Those are what this PR now contains.

The three

SubjectLinkUpsertIsConcurrencySafe. Thirty goroutines at one tuple. SubjectLinkUpsertIsIdempotent proves a second call updates rather than collides when it arrives afterwards, and says nothing about both arriving together. A subject link is written on every SSO sign-in, so two writes for one subject is what happens when somebody opens two tabs. A read-then-write implementation loses that race: both readers miss, both insert, and the loser surfaces a raw constraint error instead of succeeding. Every call must return nil and exactly one row must survive, which a deterministic write after the storm settles confirms.

ActiveSignalsAreEnvironmentScoped. A signal raised in production must not raise the risk on a development sign-in for the same app and user. A query filtering on app and user that forgets the environment predicate fails here and nowhere else.

DomainLookupIsOrgScoped. The tenancy level below DomainLookupIsAppScoped. One company runs SSO for several of its own organizations, and the partial unique index is on (app_id, org_id, domain) where active, so the same domain is legitimately configured twice inside one app. A lookup that drops the org predicate routes a user to a sibling organization's IdP. This needed an org pair on ssotest.Fixture, added in the same commit so the struct and the case land together. org_id carries no foreign key, so they need no rows.

Notes for review

The signals case passes a bare time.Now() because risk.go does. A case that builds a tidy truncated UTC input tests the store against a caller that does not exist, which is how a time-handling bug survives a green suite.

Both new ssftest cases use the package's unique() helper, since postgres and mongo share one store across every case in a backend and nothing is truncated between them.

Not in this PR

Retiring the store_* conformance family, which is the obvious end state once its unique cases are gone. My "only three cases are unique" finding came from comparing case names. That justifies not adding duplication; it does not justify deleting assertions I did not write. That wants a case-by-case audit and its own PR.

Verification

All three cases pass on all four backends (memory, sqlite, postgres via testcontainers, mongo via a single-node replica set). Full make test-integration green in 137s, go test ./... unchanged, gofmt/goimports clean. Rebased onto 27c17e7.