Env: APP_URL, WORKOS_CLIENT_ID, WORKOS_API_KEY, and one of
WORKOS_CONNECTION / WORKOS_ORGANIZATION / WORKOS_PROVIDER.
Flow: GET /api/auth/workos -> callback -> session.
Package workos adds WorkOS SSO/SAML (enterprise single sign-on) to togo auth.
It registers /api/auth/workos + callback; on success it find-or-creates the
user via auth and issues a togo session. Depends on the auth plugin.