[servicememeai]

Change

1. Preserve explicit CF_DIRECTORY_PROVIDER > legacy CF_ACL_PROVIDER. If unset and an authenticated enterprise Directory is configured, read a validated, fresh /groups?view=entities snapshot once per Hub worker/config. Use its optional provider (Etech responds etech), else retain generic external. The same provider_name() is already used by ACL principal, group mapper and readiness keys. No per-request Directory RPC on warm ACL paths.
2. Ignore retired CF_SSO_EAP_PROFILE_IDENTITY in OAuth login and callback rather than rejecting existing Etech configurations. The current verified userId → login_id, OAuth state/subject, existing-account binding and ordinary CE Cookie machinery remain unchanged. /ssoAuth is an EAP route and is not renamed.
3. Add narrow pure tests for explicit precedence, old Directory fallback, malformed/stale catalogs, and namespace validity.

Scope / compatibility

• No new tables, service, scheduler, API endpoint, parameter or environment change; all existing etech ACL and group data remain in place.
• No changes to standalone CE or custom explicit Directory providers.
• No EAP DEV access or deployment; GitHub CI only.
• Existing deployed settings win even if Directory response differs, by design. Directory fetch failure is fail-closed.
• The legacy Docker flag may remain in previously generated files but is ignored in Hub.

Partner EAP branch declares the provider in its existing protected response. Related EAP #30.