refactor(2meet-data-optimizer): stop registering the sso group in core

- TMDO_Member_Fields no longer registers user/sso; the definition moved
  unchanged (hash 03543f19) to 2meet-data-optimizer-sso-addon.
- missing_integration_addons(): 2meet-hub-core or 2meet-spoke-sso without
  the SSO AddOn is reported (admin notice + Site Health).
- The deprecated-AddOn notice points hub / spoke users to the SSO AddOn.
- Sites must activate the SSO AddOn before this ships (PR-041); aeav_only
  sites without it fall back to orphan-group restore.
- Verify: core unit 659 / integration 475, SSO 6, HP 142/49, WC 10/22
  green, phpcs clean
- PR: PR-040

includes/class-tmdo-compatibility.php

@@ -85,6 +85,10 @@ class TMDO_Compatibility {
 		if ( self::is_woocommerce_active() && ! class_exists( 'TMDO_Woocommerce_Bootstrap' ) ) {
 			$missing['WooCommerce'] = '2meet-data-optimizer-woocommerce-addon';
 		}
+		// 2meet-hub-core / 2meet-spoke-sso read and write the user `sso` group it owns.
+		if ( ( class_exists( 'TMHC_Plugin', false ) || class_exists( 'TMSO_Plugin', false ) ) && ! class_exists( 'TMDO_SSO_Integration', false ) ) {
+			$missing['2meet Hub / Spoke SSO'] = '2meet-data-optimizer-sso-addon';
+		}
 		return $missing;
 	}
 

includes/integrations/class-tmdo-member-fields.php

@@ -15,13 +15,13 @@ if ( ! defined( 'ABSPATH' ) ) {
 }
 
 /**
- * Registers four user entity groups for membership, activity, profile, and SSO.
+ * Registers the user entity groups for membership, activity and profile.
  *
  * Groups → flat tables:
  *   membership → wp_wpdo_user_membership (tier, points, expiry — high-freq search)
  *   activity   → wp_wpdo_user_activity   (login counters, last-active — high-freq write)
  *   profile    → wp_wpdo_user_profile    (display fields, specialties — low-freq write)
- *   sso        → wp_wpdo_user_sso        (Hub token cache, replaces _tmso_* usermeta)
+ *   (sso → wp_wpdo_user_sso is owned by 2meet-data-optimizer-sso-addon)
  *
  * Called from TMDO_Core::run() before wpdo_register_entity_fields fires.
  * Pattern mirrors TMDO_WooCommerce::register() / register_user_entity_fields().
@@ -61,7 +61,6 @@ final class TMDO_Member_Fields {
 		self::register_membership_group();
 		self::register_activity_group();
 		self::register_profile_group();
-		self::register_sso_group();
 		self::register_core_profile_group();
 		self::register_social_group();
 		self::register_commerce_group();
@@ -213,70 +212,6 @@ final class TMDO_Member_Fields {
 		);
 	}
 
-	/**
-	 * Hub/Spoke SSO token cache — replaces _tmso_* usermeta.
-	 *
-	 * Silent refresh fires every 15 min per user; at 10M users this is a
-	 * high-frequency EAV hot-spot. A flat table + object cache hit cuts DB
-	 * load 10–50× versus a wp_usermeta EAV scan per refresh.
-	 *
-	 * last_id_token is NOT stored in plaintext (privacy + volume). Only the
-	 * SHA-256 hash is kept for SLO token comparison.
-	 *
-	 * @return void
-	 */
-	private static function register_sso_group(): void {
-		TMDO_Entity_Registry::register_group(
-			'user',
-			'sso',
-			array(
-				array(
-					'key'        => 'hub_global_user_id',
-					'type'       => 'text',
-					'searchable' => true,
-					'label'      => 'Hub global user UUID (2mso_user_mapping.global_user_id bridge key)',
-				),
-				array(
-					'key'   => 'picture_url',
-					'type'  => 'text',
-					'label' => 'Social / SSO profile picture URL',
-				),
-				array(
-					'key'   => 'last_id_token_hash',
-					'type'  => 'text',
-					'label' => 'SHA-256(last_id_token) for SLO comparison — no plaintext stored',
-				),
-				array(
-					'key'   => 'refresh_token_enc',
-					'type'  => 'textarea',
-					'label' => 'Encrypted refresh token (TMSO_Crypto — key-versioned enc_vN:ciphertext)',
-				),
-				array(
-					'key'        => 'token_expires_at',
-					'type'       => 'datetime',
-					'searchable' => true,
-					'label'      => 'SSO token expiry (set to past to force re-auth on next request)',
-				),
-				array(
-					'key'   => 'sso_last_login_at',
-					'type'  => 'datetime',
-					'label' => 'Last SSO-initiated login datetime',
-				),
-				array(
-					'key'     => 'sso_login_count',
-					'type'    => 'integer',
-					'default' => 0,
-					'label'   => 'SSO login count',
-				),
-				array(
-					'key'   => 'known_login_ips',
-					'type'  => 'textarea',
-					'label' => 'Recent login IPs JSON array (new-device notification) — replaces _tmso_known_ips usermeta',
-				),
-			)
-		);
-	}
-
 	/**
 	 * WP core user fields stored as multi-row EAV in wp_usermeta.
 	 *