fix(oidc): local-credential lockout, session hydration, split-origin gaps (codex round 3)

- OIDC-owned accounts can never authenticate locally: the password
  login rejects auth_provider='oidc' rows outright (generic 401), and
  the super-admin password reset refuses them with a clear message —
  previously a reset would have minted a local password bypassing the
  IdP's MFA/access policies
- /auth/session now returns a full adminUser payload (role join) and
  AdminAuthContext hydrates user state from it: an SSO redirect
  establishes the session without any login JSON, which left the header
  identity blank and current-admin form defaults empty
- the /sso/login error path redirects absolute to the frontend base
  (same split-origin reasoning as the callback)
- docker-compose.yml passes API_URL through to the backend (production
  compose uses env_file and needs nothing; dev compose is gitignored)
- authSession.symmetry test mock taught the joined admin lookup
  (leftJoin, prefixed columns, aliases) — the route change made the old
  mock throw, which read as "table missing, trust token"

Tests: new case pins that a known-good password on an OIDC-owned row
still gets 401. 14/14 OIDC, 13/13 symmetry.

backend/__tests__/integration/oidcSso.test.js

@@ -222,6 +222,21 @@ describe('OIDC SSO (#798)', () => {
     expect(cfg.clientSecret).toBe(idp.clientSecret);
   });
 
+  it('refuses local password login for OIDC-owned accounts', async () => {
+    // Give the JIT admin a KNOWN password hash directly in the DB — the
+    // auth_provider check must reject the login even with valid credentials
+    // (otherwise a password reset would mint an IdP-bypassing local login).
+    await db('admin_users').where({ id: agentCookies.jitAdminId }).update({
+      password_hash: await bcrypt.hash('KnownPass123', 4),
+    });
+    const row = await db('admin_users').where({ id: agentCookies.jitAdminId }).first();
+
+    const res = await request(app)
+      .post('/api/auth/admin/login')
+      .send({ username: row.email, password: 'KnownPass123' });
+    expect(res.status).toBe(401);
+  });
+
   it('returns 404 from /sso/login when SSO is disabled', async () => {
     await oidcService.saveOidcSettings({ oidc_enabled: false });
     await request(app).get('/api/auth/admin/sso/login').expect(404);