fix: decouple security group check from domain restriction

[damsleth]

Summary

• checkSecurityGroupMembership short-circuited before hitting Graph when settings.domainRestriction was unset, because mail.includes('@undefined') always returned false. This blocked every legitimate member when a tenant enabled securityGroupEnabled=true without also enabling domainRestrictionEnabled.
• The guard now gates security-group membership on securityGroupEnabled + securityGroupId only, and applies domain restriction only when domainRestrictionEnabled is true and domainRestriction has a value - matching the independent admin UI toggles.
• Adds an AVA test file covering the five branch decisions (group disabled, group id empty, group enabled with domain restriction disabled, group enabled with domain restriction enabled inside/outside the domain). Graph is stubbed via require.cache so the short-circuit branches never touch the network.

Release note

Tenants that relied on the de facto coupling (security group enabled + empty domain restriction acting as a deny-all) will now see Graph membership checks succeed. Configure both securityGroupEnabled and domainRestrictionEnabled explicitly to preserve the old semantics.

Test plan

• npm run lint
• npm test (the 5 pre-existing uncaught exceptions on dev are unrelated; new suite passes)
• Manual: tenant with securityGroupEnabled=true, domainRestrictionEnabled=false can sign in
• Manual: tenant with both flags true still blocks mail outside the configured domain