fix(oidc): local-credential lockout, session hydration, split-origin gaps (codex round 3)

- OIDC-owned accounts can never authenticate locally: the password
  login rejects auth_provider='oidc' rows outright (generic 401), and
  the super-admin password reset refuses them with a clear message —
  previously a reset would have minted a local password bypassing the
  IdP's MFA/access policies
- /auth/session now returns a full adminUser payload (role join) and
  AdminAuthContext hydrates user state from it: an SSO redirect
  establishes the session without any login JSON, which left the header
  identity blank and current-admin form defaults empty
- the /sso/login error path redirects absolute to the frontend base
  (same split-origin reasoning as the callback)
- docker-compose.yml passes API_URL through to the backend (production
  compose uses env_file and needs nothing; dev compose is gitignored)
- authSession.symmetry test mock taught the joined admin lookup
  (leftJoin, prefixed columns, aliases) — the route change made the old
  mock throw, which read as "table missing, trust token"

Tests: new case pins that a known-good password on an OIDC-owned row
still gets 401. 14/14 OIDC, 13/13 symmetry.

frontend/src/contexts/AdminAuthContext.tsx

@@ -50,12 +50,19 @@ export const AdminAuthProvider: React.FC<AdminAuthProviderProps> = ({ children }
           }
         }
 
-        const response = await api.get<{ valid: boolean; type: string; adminUsername?: string; user?: string }>(
+        const response = await api.get<{ valid: boolean; type: string; adminUsername?: string; user?: string; adminUser?: AdminUser | null }>(
           '/auth/session'
         );
 
         if (response.data?.valid && response.data.type === 'admin') {
           setIsAuthenticated(true);
+          // Redirect-established sessions (SSO, #798) never went through
+          // login(), so sessionStorage has no user — hydrate from the
+          // session payload. Server truth also refreshes stale local copies.
+          if (response.data.adminUser) {
+            setUser(response.data.adminUser);
+            sessionStorage.setItem('admin_user', JSON.stringify(response.data.adminUser));
+          }
         } else {
           sessionStorage.removeItem('admin_user');
           setIsAuthenticated(false);