fix: complete mystira identity session handoff

[JustAGhosT]

Summary

• remove the stale CSP report-only header that generated console-only inline script warnings with no report endpoint
• let Mystira OIDC callback fall back to id_token claims when userinfo rejects the access token
• add a cookie-backed /api/auth/session endpoint and hydrate the client AuthProvider from it after OIDC redirects
• align security-header docs with shipped headers

Live finding

Identity logs confirm OmniPost attempts landed on Mystira Identity: authorization and token requests for client neuralliquid-omnipost-web were validated around 2026-07-18T22:01:55Z and 22:02:07Z. Identity returned id_token/access_token, then rejected the userinfo access token with invalid_token / missing sub. OmniPost previously did not fall back to id_token claims, and even a successful callback only set an HTTP-only cookie that the client auth guard did not hydrate from.

Validation

• pnpm exec jest tests/lib/identity-provider.test.ts --runInBand
• pnpm exec eslint components/providers/AuthProvider.tsx lib/api-client.ts lib/auth/identity-provider.ts app/api/auth/session/route.ts tests/lib/identity-provider.test.ts
• pnpm exec prettier --check next.config.ts components/providers/AuthProvider.tsx lib/api-client.ts lib/auth/identity-provider.ts app/api/auth/session/route.ts tests/lib/identity-provider.test.ts docs/ARCHITECTURE.md
• pnpm run type-check
• pnpm run build

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b1a7f9b0c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add rate limiting to session checks

Because this new /api/auth/session route is public and the client now calls it on every auth-provider mount, leaving GET wrapped only in withErrorHandling lets any unauthenticated client hammer the endpoint and force repeated cookie/header parsing and JWT verification/logging. The neighboring public auth routes (/api/auth/providers and the OAuth callback) are wrapped with withRateLimit, and the repo rules require rate limiting on public endpoints, so this should use an appropriate preset before the error handler is exposed.

Useful? React with 👍 / 👎.