Resolves #285

Route and handle signin/failure invoke activities that Teams sends when SSO token exchange fails. Adds a system default handler that logs actionable warnings and emits error events, plus a signin.failure route for developer overrides.

Previously, when Teams sent a signin/failure invoke (e.g., due to an SSO misconfiguration), the SDKs silently swallowed the failure with no logging, no error events, and no developer notification. This made SSO configuration issues extremely difficult to diagnose.

User: hi
(No response from app)

The Problem

When a Teams app uses SSO (Single Sign-On) with a Token Exchange URL configured in the OAuth connection settings, Teams attempts a silent token exchange. If this fails -- for example, because the Entra app registration's "Expose an API" configuration doesn't match the Token Exchange URL -- Teams sends a signin/failure invoke activity with details like:

{
  "type": "invoke",
  "name": "signin/failure",
  "value": {
    "code": "resourcematchfailed",
    "message": "Resource match failed"
  }
}

Before this change, none of the three SDKs routed or handled this invoke. The failure was invisible to the user, SDK, and the developer. The user saw no sign-in card, no error message, and no indication of what went wrong.

Now, sign in failures with send a warning, emits error event, and return HTTP 200 by default. Developers can also register custom handlers if desired, for example:

Python:

@app.on_signin_failure()
async def handle_signin_failure(ctx):
    failure = ctx.activity.value
    print(f"Sign-in failed: {failure.code} - {failure.message}")

Example log on signin/failure:

[WARNING] @teams/app Sign-in failed for user 29:xxxxx
  in conversation a:1_xxxxx:
  resourcematchfailed — Resource match failed.
  If the code is 'resourcematchfailed', verify that your Entra app registration has 'Expose an API'
  configured with the correct Application ID URI matching your OAuth connection's Token Exchange URL.

Note that the default behavior will still appear to fail silently for the user. There will be logs, but it will be up to the developer to determine how the user experiences the sign-in failure. 'resourcematchfailed' is an example of a setup error, however, and should not be an error that a 'real' user experiences. If desired, we could potentially modify the default behavior to send something to the user, but I'm disinclined to make that decision on the behalf of the developer.

Feature work tested and verified in C#, PY, and TS.