sale order

routes/auth.js

@@ -59,6 +59,12 @@ router.post('/login', async (req, res) => {
   }
 });
 
+// NOTE: central-auth SSO login (POST /sso-login) lives in server.js's own
+// inline authRouter, not here — this file (routes/auth.js) is NOT mounted by
+// server.js (which defines its own, more complete /api/auth router with
+// modules/approvalSteps/per-company sapLogins), so anything added here is
+// dead code. See server.js's authRouter.post('/sso-login', ...).
+
 // ── GET /auth/me ──────────────────────────────────────────────────────────────
 router.get('/me', (req, res) => {
   const token = (req.headers.authorization || '').replace('Bearer ', '');