Looks up the SSO provider for the given email domain and returns a redirect URL to the identity provider's login page. Only the email's domain is used (the local part is discarded). The redirect URL embeds a single-use, server-generated state that the identity provider echoes back and the client must present on the callback.