[dnjg]

SSO (Entra/GitLab) users on routed tenants could not use the CLI: the tenant host offers only GitHub sign-in, and the router host that offers SSO serves no data endpoints.

• nullify auth login with no host (or nullify.ai / app.nullify.ai / api.nullify.ai) signs in through the router, then calls /admin/installations and stores the selected installation's data host and query parameters. Several installations prompt on a TTY or take --installation; nullify auth switch --installation changes the selection.
• Data calls (commands, MCP) go to the data host; token lookup and refresh stay on the router. A router session with no selected installation is an error, never a data call to the router.
• nullifyBaseUrl must be a plain https://api.<tenant>.nullify.ai origin before the token is sent to it.
• Explicit --host <tenant> and existing config hosts keep the single-host behaviour, including refresh query parameters and the GitHub Actions exchange (which is refused on the router host).
• nullify open sends router users to app.nullify.ai; wizard, help text, README and install.sh updated.

Not run live: a browser SSO login against the router followed by a data call to a routed tenant. That is the acceptance test before release.

Follow-ups: pentest still sends no tenant query parameters; the transports attach the token without checking the request host.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}