fix(oidc): security + robustness hardening from codex review rounds 1-2

Round 1:
- bind SSO identities to (external_issuer, external_subject): OIDC only
  guarantees sub uniqueness within an issuer, so a sub-only lookup let a
  newly configured IdP's user inherit an old IdP's admin account on
  subject collision; migration 162 gains external_issuer + composite
  unique index (unmerged migration, edited in place)
- fetch UserInfo (with sub cross-check) when the ID token carries no
  email — spec-compliant providers may serve email/profile claims only
  there; ID-token claims win on merge
- allowlist /admin/sso/login + /callback in maintenance mode, or
  SSO-only (JIT) admins are locked out exactly when they need in
- strip reserved keys (oidc_client_secret, setup_token) from BOTH
  generic settings reads (GET / and GET /:type)

Round 2:
- redirect_uri prefers API_URL (the API's public origin — where the
  state cookie lives); final redirects absolute to the frontend base;
  login button builds its URL via buildResourceUrl — split-origin
  deployments (absolute VITE_API_URL) work end to end
- PUT /sso validates the MERGED resulting state (partial update cannot
  blank issuer/client while enabled=true survives; enabling requires a
  derivable redirect URI)
- openid scope forced into oidc_scopes on save
- discovery-cache key includes a secret fingerprint (multi-worker
  secret rotation)
- email→admin linking claims the row atomically (conditional update on
  external_subject IS NULL) — concurrent first-time callbacks with the
  same verified email but different subjects can't both authenticate

Tests: mock IdP gains userinfo endpoint + email-via-userinfo-only mode;
new cases pin the userinfo merge and issuer-collision non-inheritance;
redirect assertions updated for absolute URLs. 13/13.

backend/__tests__/integration/helpers/mockOidcProvider.js

@@ -33,6 +33,8 @@ class MockOidcProvider {
     this.nextUser = { sub: 'user-1', email: '[email protected]', email_verified: true };
     // Test hooks:
     this.tamperNonce = false; // sign the ID token with a WRONG nonce
+    this.emailViaUserinfoOnly = false; // omit email from the ID token; serve it on /userinfo
+    this.accessTokens = new Map(); // access_token -> user (for /userinfo)
     this.server = null;
     this.issuer = null;
   }
@@ -81,6 +83,7 @@ class MockOidcProvider {
         issuer: this.issuer,
         authorization_endpoint: `${this.issuer}/authorize`,
         token_endpoint: `${this.issuer}/token`,
+        userinfo_endpoint: `${this.issuer}/userinfo`,
         jwks_uri: `${this.issuer}/jwks`,
         response_types_supported: ['code'],
         subject_types_supported: ['public'],
@@ -128,13 +131,18 @@ class MockOidcProvider {
         }
 
         const { sub, ...extraClaims } = stored.user;
+        // Spec-compliant providers may keep profile/email claims OFF the ID
+        // token and serve them from /userinfo only — this hook simulates that.
+        const idTokenClaims = this.emailViaUserinfoOnly ? {} : extraClaims;
         const idToken = this.signIdToken({
           sub,
           nonce: this.tamperNonce ? 'tampered-nonce' : stored.nonce,
-          extraClaims,
+          extraClaims: idTokenClaims,
         });
+        const accessToken = crypto.randomBytes(16).toString('base64url');
+        this.accessTokens.set(accessToken, stored.user);
         return json(200, {
-          access_token: crypto.randomBytes(16).toString('base64url'),
+          access_token: accessToken,
           token_type: 'Bearer',
           expires_in: 300,
           id_token: idToken,
@@ -143,6 +151,13 @@ class MockOidcProvider {
       return undefined;
     }
 
+    if (url.pathname === '/userinfo') {
+      const auth = req.headers.authorization || '';
+      const user = this.accessTokens.get(auth.replace(/^Bearer\s+/i, ''));
+      if (!user) return json(401, { error: 'invalid_token' });
+      return json(200, { ...user });
+    }
+
     return json(404, { error: 'not_found' });
   }
 }