Implement Shibboleth SAML login for biblio auth ezproxy --login

Goal

Eliminate manual cookie management for institutional PDF access. Users should be able to authenticate with their LMU credentials from a terminal (no browser needed) and have biblio handle the SAML flow automatically.

Context

• LMU EZProxy at emedien.ub.uni-muenchen.de uses Shibboleth SAML2 via lmuidp.lrz.de
• HPC server is on LMU network but IP-based auto-auth is NOT enabled
• Current approach requires browser login + cookie copy (expires every few hours)
• SAML flow was traced on 2026-04-03 — standard POST binding, form-based IdP login

Acceptance Criteria

• [ ] biblio auth ezproxy --login prompts for username + password (hidden), does SAML flow, saves cookies
• [ ] biblio bibtex fetch-pdfs-oa successfully fetches a paywalled paper after --login
• [ ] Works over plain SSH (no display/browser required)
• [ ] requests and beautifulsoup4 are optional — graceful error message if missing
• [ ] Tutorial updated in institutional-access.md

Result

(Filled in after execution)