🩺 Log rejected SAML auth responses with error reason and relay-state context

[Actalab]

Adds a Logger.warning at the single choke point where consume_signin_response/1 rejects an IdP auth response, so failures surface the concrete reason (:invalid_relay_state, signature/decode errors, :invalid_idp_id, …) instead of being swallowed into a session that is dropped on the cross-site ACS POST.

Logs the error, idp_id, whether the IdP echoed a RelayState, and whether it was still in the cache — enough to tell apart a dropped/mangled RelayState from a decode/validation failure.