Add KEY-WP-0041 for the NK-WP-0051-T02 sign-in diagnosis page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52

workplans/KEY-WP-0041-sign-in-diagnosis-page.md

@@ -0,0 +1,54 @@
+---
+id: KEY-WP-0041
+type: workplan
+title: "Sign-in diagnosis page and auth log uid (NK-WP-0051-T02)"
+domain: infotech
+repo: key-cape
+status: active
+owner: claude-code
+topic_slug: netkingdom
+created: "2026-10-14"
+updated: "2026-10-14"
+flavor: implementation
+depends_on: []
+---
+
+Demand: NetKingdom `NK-WP-0051-T02`. The field names (`uid`, `groups`,
+`assurance`, `client_id`) and the never-show/never-log list come only from
+`net-kingdom/docs/sign-in-diagnosis.md`; this workplan does not restate them.
+
+## Opt-in pre-redirect page and auth log fields
+
+```task
+id: KEY-WP-0041-T01
+status: done
+priority: high
+```
+
+- Client registration flag `signInDiagnosis` (default false) in the YAML
+  config, `domain.Client` and `spec/canonical-model.yaml`.
+- With the flag on, `/authorize/callback` renders a page before the redirect
+  with `uid`, sorted `groups`, `assurance` and `client_id`, one continue link
+  to the unchanged redirect (code + state), and a sign-out hint. html/template
+  escaping, `no-store`, `Referrer-Policy: no-referrer`, restrictive CSP.
+- `assurance` is `aal2` only when this request verified a one-time code; a
+  reused aal2 session is `aal1` (contract wording, stricter than the session
+  satisfied `MFAVerified`).
+- The `auth_success` log line gains `uid` and `assurance` beside `client_id`.
+- Enabled for `openbao-admin` in `config/dev-config.yaml`; the live flag is set
+  in `sso/keycape-config` (see `docs/operations.md`).
+- Tests: `src/internal/server/oidc/signin_diagnosis_test.go`.
+
+## Deploy the image and record its digest
+
+```task
+id: KEY-WP-0041-T02
+status: todo
+priority: high
+```
+
+Build and push with `make push IMAGE_TAG=<sha>`, set `signInDiagnosis: true`
+on the OpenBao browser client in `sso/keycape-config`, roll the issuer under
+the usual live-change approval, and send the digest to net-kingdom for the
+evidence table in `docs/sign-in-diagnosis.md`. Not done by the implementing
+session: deployment needs operator approval.