tegwick af3b1b0dfb Add opt-in sign-in diagnosis page and uid/assurance on auth log (NK-WP-0051-T02). ... A client registration flag, signInDiagnosis (default off), makes the callback render uid, sorted groups, assurance and client_id before the redirect, with one continue link to the unchanged code. assurance is aal2 only when this request verified a one-time code. The auth_success log line now carries uid and assurance beside client_id. Enabled for openbao-admin in the dev config; the live flag is documented in docs/operations.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52		2026-10-14 23:45:11 +02:00
..
dev-config.yaml	Add opt-in sign-in diagnosis page and uid/assurance on auth log (NK-WP-0051-T02).	2026-10-14 23:45:11 +02:00
service-clients.example.yaml	Correct platform infrastructure client tenant bindings	2026-09-27 16:43:31 +02:00