Add opt-in sign-in diagnosis page and uid/assurance on auth log (NK-WP-0051-T02).

A client registration flag, signInDiagnosis (default off), makes the
callback render uid, sorted groups, assurance and client_id before the
redirect, with one continue link to the unchanged code. assurance is aal2
only when this request verified a one-time code. The auth_success log
line now carries uid and assurance beside client_id. Enabled for
openbao-admin in the dev config; the live flag is documented in
docs/operations.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52

config/dev-config.yaml

@@ -31,6 +31,8 @@ clients:
     allowedScopes: ["openid", "profile", "email", "groups"]
     grantTypes: ["authorization_code"]
     clientType: "public"
+    # NK-WP-0051-T02: show uid/groups/assurance/client_id before returning.
+    signInDiagnosis: true
   - clientId: "demo-app"
     displayName: "Demo Application"
     redirectUris: