A retailer wants to implement SSO (Single Sign-On) so customers can use a single identity across B2C Commerce, an Experience Cloud portal, and a mobile app. What identity federation protocols (SAML, OpenID Connect) and Salesforce capabilities are involved, and what are the architectural constraints?