Tenant-scoped auth validation

Select a tenant to start an OIDC authorization request pinned to that Zitadel org.