NOR-92: Fix OIDC identity and managed member setup

[logabell]

Trailing-slash OIDC issuers were changed during discovery/save, causing otherwise valid signed tokens to fail. This preserves the exact issuer through discovery, save, and returning sign-in, and adds the missing managed-member controls.

• Support Administrator, Approver, Member, Requester, and Viewer defaults and group mappings. Apply the existing permission presets correctly, document group precedence, and retain password-account and last-administrator safeguards.
• Add an administrator-only onboarding preference, enabled by default. Disabling it lets pending Member/Viewer accounts browse after local or OIDC sign-in while preserving progress, personal credentials, and library grants. Other access presets retain their setup behavior; the wizard remains available from Settings → General.
• Preserve edits made while an OIDC settings save is in flight; a completed response previously reset newer changes.

Issuer compatibility: explicitly correcting one trailing slash migrates existing links and rejects conflicting links. Changing another part of the issuer, including another realm/path on the same host, removes the previous issuer's links rather than transferring identities between providers. Token and discovery issuer comparisons remain exact; mismatch diagnostics omit secrets.

Migration 0080_member_setup preserves existing provider settings, adds the two group fields and onboarding policy, and refuses downgrade when it would lose the new configuration. The backup schema marker and generated API types are updated.

Validation: 85 focused backend checks and 11 Chromium browser journeys passed, run serially through python3 scripts/check.py. Frontend build/typecheck, generated API consistency, migrated-schema alignment, Ruff, Prettier, and git diff --check passed. Baseline regressions demonstrated the stripped issuer and unsafe cross-realm link transfer. Browser checks cover delayed-save responses, all role choices, persisted policy, required/skipped onboarding, and reopening setup.

BOOK_TEST_DATABASE_URL=<disposable_database_ending_in_test> python3 scripts/check.py backend \
  tests/integration/test_oidc.py tests/integration/test_onboarding.py tests/unit/test_oidc.py \
  tests/integration/test_member_setup_migration.py tests/integration/test_schema_alignment.py \
  tests/integration/test_proxy_auth.py tests/integration/test_auth.py tests/unit/test_auth_diagnostics.py \
  tests/unit/test_state_bundle_validation.py::test_supported_bundle_schema_tracks_the_single_migration_head \
  tests/integration/test_request_approvals.py::test_request_waits_for_approval_unless_the_account_can_download
python3 scripts/check.py ui member-setup.spec.ts account-sign-in.spec.ts user-access-setup.spec.ts

OIDC verification uses a controlled HTTP identity provider with real signed tokens and PKCE, not the reporter's Authentik deployment. NOR-64 / #27 remains unresolved: HTTPS public-origin sessions over an HTTP upstream pass with preserved and rewritten Host, but the requested KeenDNS runtime configuration and correlated rejection evidence are still missing. This PR does not change proxy trust or origin validation.

Fixes NOR-92
Fixes NOR-93
Fixes NOR-101
Fixes #59
Fixes #60
Fixes #68

PR review follow-up

The shared library-review browser check could fail when “Save and review next” displayed the completed-link status and the next catalog-search status together. The fixture now holds that next lookup pending, checks both messages separately, and waits for the lookup to finish before continuing. The ambiguous assertion failed under this controlled timing before the fix; no product behavior or timeout was changed.

Follow-up validation: production build/typecheck and 7 Chromium journeys passed via python3 scripts/check.py ui library-review.spec.ts member-setup.spec.ts, including required/optional onboarding and administrator settings.

[linear-code]

NOR-93

NOR-101

NOR-92

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T06:04:07.695794Z	79e4003	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.