### Feature request

Please publish or backport the complete interactive SSO DCR bridge flow on top of v1.93.0 and document the first release that contains it.

### Current v1.93.0 behavior

The tag contains the DCR envelope consumer and `build_bridge_token_response`, but `exchange_token_with_server` returns the upstream access token directly and never calls the bridge producer. A managed Claude DCR client therefore cannot receive the gateway-bound employee credential expected by the DCR admission path.

Separately, using the `litellm-dashboard` UI session key as the bridge subject does not give the employee explicit server/tool permissions when `require_key_mcp_access_defined: true`.

### Required security contract

- Interactive DCR/PKCE captures the immutable SSO user subject. - The client-held credential is bound to exactly one MCP server. - Each call reloads live user and team object permissions, including explicit `mcp_servers` and `mcp_tool_permissions`. - Permission removal, key revocation, and SCIM offboarding affect the next call without reconnecting. - Missing/ambiguous identity or unavailable permission storage fails closed. - The upstream provider token is never re…