fix(oidc): local-credential lockout, session hydration, split-origin gaps (codex round 3)

- OIDC-owned accounts can never authenticate locally: the password
  login rejects auth_provider='oidc' rows outright (generic 401), and
  the super-admin password reset refuses them with a clear message —
  previously a reset would have minted a local password bypassing the
  IdP's MFA/access policies
- /auth/session now returns a full adminUser payload (role join) and
  AdminAuthContext hydrates user state from it: an SSO redirect
  establishes the session without any login JSON, which left the header
  identity blank and current-admin form defaults empty
- the /sso/login error path redirects absolute to the frontend base
  (same split-origin reasoning as the callback)
- docker-compose.yml passes API_URL through to the backend (production
  compose uses env_file and needs nothing; dev compose is gitignored)
- authSession.symmetry test mock taught the joined admin lookup
  (leftJoin, prefixed columns, aliases) — the route change made the old
  mock throw, which read as "table missing, trust token"

Tests: new case pins that a known-good password on an OIDC-owned row
still gets 401. 14/14 OIDC, 13/13 symmetry.

backend/__tests__/integration/oidcSso.test.js

@@ -222,6 +222,21 @@ describe('OIDC SSO (#798)', () => {
     expect(cfg.clientSecret).toBe(idp.clientSecret);
   });
 
+  it('refuses local password login for OIDC-owned accounts', async () => {
+    // Give the JIT admin a KNOWN password hash directly in the DB — the
+    // auth_provider check must reject the login even with valid credentials
+    // (otherwise a password reset would mint an IdP-bypassing local login).
+    await db('admin_users').where({ id: agentCookies.jitAdminId }).update({
+      password_hash: await bcrypt.hash('KnownPass123', 4),
+    });
+    const row = await db('admin_users').where({ id: agentCookies.jitAdminId }).first();
+
+    const res = await request(app)
+      .post('/api/auth/admin/login')
+      .send({ username: row.email, password: 'KnownPass123' });
+    expect(res.status).toBe(401);
+  });
+
   it('returns 404 from /sso/login when SSO is disabled', async () => {
     await oidcService.saveOidcSettings({ oidc_enabled: false });
     await request(app).get('/api/auth/admin/sso/login').expect(404);

backend/__tests__/routes/authSession.symmetry.test.js

@@ -32,9 +32,17 @@ jest.mock('../../src/database/db', () => {
     if (table === 'admin_users') {
       let rowFilter = () => true;
       return {
+        // The session route joins roles for the adminUser payload (#798);
+        // fake rows carry no role fields, so the join is a pass-through.
+        leftJoin() {
+          return this;
+        },
         where(criteria) {
           rowFilter = (row) => {
-            return Object.entries(criteria).every(([k, v]) => {
+            return Object.entries(criteria).every(([rawKey, v]) => {
+              // Joined queries prefix columns ('admin_users.id') — the fake
+              // rows use bare names.
+              const k = rawKey.replace(/^admin_users\./, '');
               if (k === 'is_active') return Boolean(row.is_active) === Boolean(v);
               return row[k] === v;
             });
@@ -50,7 +58,12 @@ jest.mock('../../src/database/db', () => {
           if (!row) return undefined;
           if (!this._cols) return row;
           const out = {};
-          for (const c of this._cols) out[c] = row[c];
+          for (const c of this._cols) {
+            // Support 'table.col' and 'table.col as alias' shapes.
+            const [source, alias] = c.split(/\s+as\s+/i);
+            const bare = source.includes('.') ? source.split('.').pop() : source;
+            out[alias || bare] = row[bare];
+          }
           return out;
         },
       };