I think you could get pretty close with OAuth2. You could also have the frontend be a centralized app, but allow people to host their own servers. If the entity controlling the frontend goes off the rails you still have a pretty simple exit strategy.
OAuth2 is a failed protocol - it's more of a set of guidelines for vendors to implement proprietary authentication systems, all incompatible with each other.
I looked into Zulip a couple years ago and they didn't support this. Have they implemented OAuth2 or something since then? Specifically being able to log in once and be able to jump between any number of self hosted servers.