Sub-ticket of PLUTO-465 Option A: drop domain gate at login callback + allow non-allowlisted domains on access-request/approval path (Elazar decision 2026-07-02) · pluto