…false success

switch_org() treated any status=='OK' response as a completed switch, but
the server overloads that status for two different outcomes: a real switch
(data has pk/org_name/organization_slug) and an SSO re-authentication
challenge (data['idp'] populated) for members of SSO-protected orgs who
aren't the owner/admin. The challenge case never actually updates the
server-side active org, so treating it as success silently left callers on
their previous org while locally claiming to have switched.

Now raises with the idp names and a pointer to sso_login(org_name=...) as
the alternative, instead of logging a false "Switched to organization" and
setting self.session.org_name to a value the server never accepted.