test(auth): harden OIDC failure cleanup

[moncher-dev]

Issues — Closed #164

TL;DR

• Harden OIDC callback failure regression coverage by asserting eb_oidc_tx is cleared on failed state, nonce, and expired transaction paths.
• Document the epic-level Authentik/Dex verification split and local-login-off coverage for issue #164.
• Add a patch changeset for @evidence-browser/api because this PR touches packages/**.

변경 지점 다이어그램

• packages/api/src/routes/auth-oidc.test.ts → verifies callback failure cleanup for the signed OIDC transaction cookie.
• README.md → records issue #164 Authentik sign-off context and local-login-off regression coverage.
• docs/ACCEPTANCE_CRITERIA.md → ties AC-04 verification to issue #164 and the failure cleanup tests.
• .changeset/oidc-failure-cleanup.md → patch release note for OIDC verification hardening.

여기부터 보세요

• packages/api/src/routes/auth-oidc.test.ts for the concrete security regression assertions.
• README.md Authentik OIDC setup section for operator-facing sign-off notes.

위험 & 롤백

• Risk is low: no runtime code changed; tests/docs only.
• Rollback is a normal revert of the two commits if the documentation wording or release-note scope needs different ownership.

변경 파일

• .changeset/oidc-failure-cleanup.md
• packages/api/src/routes/auth-oidc.test.ts
• README.md
• docs/ACCEPTANCE_CRITERIA.md

Evidence

• npm -w @evidence-browser/api run test -- src/routes/auth-oidc.test.ts — pass
• npm run lint — pass
• npm test — pass
• npm run build — pass
• npm -w @evidence-browser/web run e2e -- e2e/login-auth-config.spec.ts — pass
• npm -w @evidence-browser/web run e2e:oidc — pass

머지 후/사람 확인

• Confirm Authentik application redirect URI exactly matches OIDC_REDIRECT_URI.
• Confirm production deployment sets AUTH_SECRET and OIDC client credentials securely.

[hojinzs]

Project #14 watchdog review — PR #179

Approve. I reviewed the PR head 4265450400a2466e732c061cf01bf4954456f81f against main.

Scope and result

• 4 files changed, +19/-2
• OIDC failure-cleanup assertions, documentation, and changeset only
• No runtime code, dependency, auth configuration, or secret changes
• No blocking correctness, security, or regression findings
• The added assertions are load-bearing: the cookie lookup helper throws when eb_oidc_tx is absent

Verification

• npm run lint — pass
• npm test — pass (shared 53, API 204, web 29, CLI 51 tests)
• npm run build — pass
• npm -w @evidence-browser/api run test -- src/routes/auth-oidc.test.ts — pass
• git diff --check — pass

Browser/Dex E2E was not rerun locally because the required environment was unavailable; CI checks are successful. Non-blocking follow-ups are recorded in the evidence bundle.

Evidence: https://evidence-browser.dev0.daniworks.kr/w/evidence-browser/b/project14-pr-179-20260821-060405z