feat: add the connected-app consent screen with step-up, and run the OAuth server in Production - #1144

Closes #798

Slice 4 of #788. This PR replaces #795's self-approving stub with real consent, adds the consent screen a connected app sends people to, and turns the OAuth server on in Production.

Before a release with this change is deployed

The deployment repo must set OAuth__Issuer to the public https URL, for example https://farm.example/. Without it the Production serving container refuses to start. One-shot verbs (migrate, bootstrap-admin and the others) do not need it.

Release note

This PR must ship in the same release as #799 (Connected apps on Account). The consent screen tells people to "Disconnect it anytime in Account › Connected apps", and #799 builds that place. The maintainer's rule is that no release is cut between merging #798 and #799.

What people see

Screenshots at 1280 and 390, from a stack rebuilt at the head, are in the screenshot comment on this PR. The picks are in docs/designs/788-oauth-screens/SELECTION.md, and the direction lab is beside it.

• Login B. When sign-in continues to a connected app, the brand panel says "Next: approve ". On a phone, the box sits above the form. The app name comes from an anonymous preview of the same validated authorize request, and it returns nothing but the app's self-chosen name.
• Consent D, at /connect. A compact card: the question, an Unverified app marker, two permission rows, where the browser returns, and "Acts as you, with only your access" with the user's role. Then Your current password, Allow and Cancel, the undo line, and a closed Details section. The signed-in email sits at the top in normal text colour and semibold weight, and Not you? Sign out is in Details. Details states what the request would reach: its scopes, within the user's role and flock scope. A Worker with assignments reads the assigned flocks' names; a Worker with none, like every other role, reads every flock. Focus starts at the headline, so a screen reader begins at the request and a phone keeps its keyboard closed; a wrong password returns focus to the field. "Record daily entries" makes no promise about drafts; MCP slice 6: write tool — record daily entry #809 adds that line once the write tool's behaviour is settled. A role that cannot record entries sees "Not allowed for your role" on that row.
• Asks for more. The new permission comes first, tinted and marked New; the earlier one reads Already allowed.
• Reconnect. An app already approved for everything it asks gets a slim card that asks for the password only.
• One step-up field. StepUpPasswordField replaces the six inline copies on the Users screen and serves the consent card. The 167 Users specs pass unchanged.
• Copy is in en, es and tl, with Help (a "Connecting an app" bullet) and the in-app glossary and GLOSSARY.md ("Connecting an app", next to OAuth slice 6: audit provenance — record which application acted, alongside the human #800's "Connected app").

Precache

The maintainer approved a second milestone raise, to 1,950 KiB. web/scripts/verify-sw.mjs and docs/designs/822-mui-revamp.md record it beside #800's earlier note. After merging main with #800, this branch measures 1,923.35 KiB, so #798 adds about 20 KiB on top of #800. About 10 KiB of that is strings in three languages, and the rest is code. The planned way to win the space back is to stop precaching the languages a device does not use, which is tracked separately.

How the flow works

The SPA holds its access token in tab memory. A browser navigation to the authorize endpoint therefore carries no bearer, and fetch cannot read a cross-origin redirect. So GET /api/v1/oauth/authorize answers three callers.

Allow repeats the request with X-Cluckwork-Step-Up. Cancel repeats it with X-Cluckwork-Consent: deny, and the client then receives access_denied. The consent payload is { clientId, clientName, redirectHost, scopes, alreadyAllowed, alreadyApproved, assignedFlocks }. assignedFlocks is the flock scope this request resolved: null for every flock, else the assigned flocks' names, read through IAccessModule. When alreadyApproved is true, the SPA asks for the password only.

Decisions

• The new IAccessModule method. ConsumeStepUpGrantAsync(accountId, userId, stepUpToken, ct) validates and spends a Require recent step-up authentication for privileged user administration #308 grant, the same way the user-administration handlers do. IStepUpGrantService stays internal to Access. The ledger gains the adapter row OAuthEndpoints.Authorize -> Access.
• Consent rules. All or nothing, and no path issues a code without a spent step-up grant. Approval creates a permanent authorization that holds the requested scopes. If one valid permanent authorization of the same user for the same app already holds every requested scope, the payload sets alreadyApproved, and the reconnect asks for the password only and reuses that authorization. A wider request shows the permissions again, and alreadyAllowed names what was approved before.
• The redirect host shown on consent comes from the redirect URI that OpenIddict validated. A client with one registered URI may omit redirect_uri.
• Scopes. The two scopes are farm:read and daily-entries:write. A request with no scope defaults to farm:read. Scope permissions are ignored per client, because every client registers itself anonymously.
• The Production config key. A Production serving process requires OAuth:Issuer. It must be an absolute https URL with no query or fragment, and the check is serving-only (refactor(api): make process role explicit for boot guards #347). The sim harness, deploy/.env.example, ProcessRoleGuardTests (two rows) and ServingGuardCoverageTests all carry it. The AppHost runs Development, where appsettings.Development.json already sets an issuer. Its tests pass unchanged.
• Discovery URLs come from the issuer. OAuth slice 1: stand up OpenIddict — tables, migration, token issuance #795's discovery used whatever Host the client called. Behind a proxy that Host can be an internal name, so discovery now rebases the authorization, token and registration endpoints onto the issuer.
• The return path after sign-in. Login reads its destination from router state, never from a query parameter. returnPath sends anything that resolves to another origin back home. That covers absolute URLs, //host and /\host. Only /connect keeps its query.

Decision: a reconnect skips the permissions, never the password

The first version skipped both the screen and the password when an app asked for nothing new. Review showed what that allowed. Someone with only a stolen session access token could get a code for an already-approved app from the JSON response. That code becomes a token that never expires. The maintainer decided that every connection asks for the password, and a reconnect skips only the permission explanation. App tokens never expire, so people reconnect rarely, and the password costs little each time. docs/decisions/798-oauth-consent.md records the decision and the alternative it rejected, which was validating the refresh cookie as a second browser proof.

Proof

• OAuthConsentTests (new) drives each consent rule. A bearer-only reconnect gets no code. A reconnect spends its grant, and a replayed grant is refused. The suite also covers the JSON redirect with state and iss, cancel, a signed session JWT expired past the 30-second skew, a malformed bearer, an omitted redirect_uri, the read-only default, refused response modes, an unknown scope, and discovery from a second host.
• OAuthConsentTests.Preview_WithoutASession_NamesTheAppOnly pins the login preview to the app's name alone.
• OAuthServerProductionTests runs the whole connect flow in a Production host: registration, the navigation hand-off, consent, step-up and token redemption. It also shows that four bad issuers stop the host from starting, a bare # among them.
• Local runs: the OAuth filter (102/102) and CredentialEpochTests; ProcessRoleGuardTests (58/58), ServingGuardCoverageTests, FixturePortRegistrationTests and OtlpSubprocessExporterTests (11/11) earlier in this PR; the Application architecture tests; the AppHost tests; tsc; and the Vitest specs below.
• Vitest: 18 ConnectPage specs. They cover each screen state (normal, wrong password, asks for more, reconnect, Details and sign-out, a role that cannot record, a web app's host, cancel, refused, the prominent email). They also cover Details for a Worker with assignments, a Worker with none, a Manager asking only to read, and a Manager asking for both, plus initial focus for consent and reconnect and focus after a wrong password. Also 3 Login B specs, 1 AuthShell spec, the 167 Users specs on the shared field, and the style, i18n, Help and glossary guards.
• Vitest mutations on the consent page. Ignoring assignedFlocks fails the scoped-Worker spec, and choosing the write sentence by role alone fails the read-only spec. Removing the heading focus fails both initial-focus specs, and removing the retry focus fails the wrong-password spec. Putting autoFocus back on the password survives, as an equivalent mutant: the heading-focus effect runs after the input mounts and takes focus back, so focus still starts at the request.
• tools/oauth/mutation-check.sh has 86 mutants. The full run at 6368134 killed 83 and held redirect-fragment, where OpenIddict still refuses the URI. After the merge with OAuth slice 6: audit provenance — record which application acted, alongside the human #800 and review round 3, I reran all 27 mutants on OAuthEndpoints.cs, which both changed, at 887a7b2. They include the two new ones: scoped-worker-unrestricted (a scoped Worker told every flock) and unassigned-worker-scoped (an unassigned Worker told a flock list). All 27 are killed, with baseline and restore green at 105/105. One of them, reconnect-without-password, needed its anchor regenerated for the payload's new field first. The 59 mutants on other files last ran at 6368134; the merge changed none of the files they mutate.
• Vitest mutations. Removing the origin check fails the absolute and protocol-relative cases. Dropping the /connect query fails the Login test.
• tools/simulation/verify-harness.sh passes the bootstrapped .env.sim and refuses OAuth__Issuer=https://cluckwork-sim.local/?tenant=1, and it now refuses a bare ? or # as the boot guard does.
• Rate-limit flakes, fixed. The fixed window is aligned to the clock, so two requests that straddle a 60-second boundary both pass. AuthorizeEndpoint_IsRateLimited failed that way in CI, and TokenEndpoint_IsRateLimited failed that way locally. Both tests came from OAuth slice 2: fail-closed checks on the OAuth path (disabled, suspended, must-change-password, flock scope, rate limit) #796. Commit 2624649 pins a one-day window in the tests that tighten an OAuth limit, as CI: root-cause the four remaining integration flakes #840 did for MultiInstanceRateLimitTests.
• Service worker swallows server-issued redirects, so ?farm= never reaches the login form #778, on a built SPA with the service worker active. The isolated cw798 stack ran Production config, rebuilt at the head, behind an https edge with a matching OAuth__Issuer. A browser navigation to the authorize endpoint went to /connect and then to /login, which named the app, with the service worker in control. After sign-in, the browser returned to /connect with the request intact. Allow with the password reached the app's loopback callback with code and state, and a password-only reconnect issued a code that redeemed with 200. One earlier run of the capture script timed out waiting for the callback on the last reconnect. The app logged no error for it, and three reruns passed, so it is recorded here rather than explained.

For #799 and later

• Disconnect must revoke every valid authorization of the user for that app. Two approvals that race can create two.
• prompt and max_age are ignored, so prompt=consent cannot force the screen.
• Whether connecting and cancelling should write audit events is still open (question 4 on the mockups).