Start hosted login automatically from Review

[deefour]

Summary

• start the hosted OIDC/WorkOS login flow automatically when Review discovers a private-team deployment without a session
• preserve the complete Review path and query as the post-login destination
• retain the existing manual gate for local-owner mode
• use a layout effect and an empty render during handoff so users do not see a redundant Artifact Server sign-in splash

Verification

• targeted redirect tests: 5 passed
• application suite: 321 passed
• browser suite: 27 passed
• Cloudflare deployment suite: 37 passed
• AWS and GCP deployment suites passed
• native/S3 and external-storage suites passed
• OIDC suite was included in the application gate and passed

pnpm verify:iteration advanced through all of the above and stopped later at the multi-architecture OCI build because the local Docker host lacks ARM64 emulation (exec format error). Repository CI remains the authoritative multi-architecture gate.