Say in the SSO notes that Authentik's tile cache needs clearing after an edit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/sso.md

@@ -113,7 +113,9 @@ Authentik's library lists Authentik's own applications, and ipx signs in through
 called `Cloudflare Access`, so ipx needs a bookmark of its own to show up there. It is
 Applications → Applications → `iPX` (slug `ipodderx`): no provider, launch URL
 `https://ipodderx.sdf1.net`, and web/logo.svg at 512px as its icon, uploaded again when the logo
-changes. Like Outline's, it has no policy bindings, so everyone in Authentik sees the
+changes. The library keeps each person's list of tiles in a cache that an edit to the application
+does not clear, so after one, clear it (System → Policies → Clear cache, or
+`POST /api/v3/policies/all/cache_clear/`) or the old name and icon stay up. Like Outline's, it has no policy bindings, so everyone in Authentik sees the
 tile. Who actually gets in is still up to the Access policy.
 
 ### Check it