fix: move SAML jackson opts out of module scope into init()

`opts` was declared as a module-scope const in a `"use server"` file,
which react-doctor flagged as `server-no-mutable-module-state`
(Server, error). Although the object happens to be read-only today,
the container itself is shared across requests — any future mutation
(e.g. dynamically overriding `db.url`) would silently affect every
request.

Move the object construction inside `init()`, gated by the same
"controllers not yet initialized" check that already wraps the
expensive setup. This is a no-op for cache-hit calls (object is never
constructed) and behaviorally identical for the first call.

The intentional `globalThis` singleton cache for the SAML controllers
themselves is left in place — that's a deliberate cross-request cache,
not unintentional shared state.

Verified via `pnpm --filter @formbricks/web test`: 5166/5166 pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/modules/ee/auth/saml/lib/jackson.ts

@@ -5,17 +5,6 @@ import { SAML_AUDIENCE, SAML_DATABASE_URL, SAML_PATH, WEBAPP_URL } from "@/lib/c
 import { preloadConnection } from "@/modules/ee/auth/saml/lib/preload-connection";
 import { getIsSamlSsoEnabled } from "@/modules/ee/license-check/lib/utils";
 
-const opts: JacksonOption = {
-  externalUrl: WEBAPP_URL,
-  samlAudience: SAML_AUDIENCE,
-  samlPath: SAML_PATH,
-  db: {
-    engine: "sql",
-    type: "postgres",
-    url: SAML_DATABASE_URL,
-  },
-};
-
 declare global {
   var oauthController: IOAuthController | undefined;
   var connectionController: IConnectionAPIController | undefined;
@@ -28,6 +17,17 @@ export default async function init() {
     const isSamlSsoEnabled = await getIsSamlSsoEnabled();
     if (!isSamlSsoEnabled) return;
 
+    const opts: JacksonOption = {
+      externalUrl: WEBAPP_URL,
+      samlAudience: SAML_AUDIENCE,
+      samlPath: SAML_PATH,
+      db: {
+        engine: "sql",
+        type: "postgres",
+        url: SAML_DATABASE_URL,
+      },
+    };
+
     const ret = await (await import("@boxyhq/saml-jackson")).controllers(opts);
 
     await preloadConnection(ret.connectionAPIController);