Show an existing NetKingdom sign-in before the account site continues it.

The account site said "Not signed in" while Authelia still had a session, and Sign in reused that identity. Ask Authelia who the session cookie is, show that name, and send a fresh sign-in only when a different identity is requested.

Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f

src/user_engine/runtime.py

@@ -15,6 +15,7 @@ from user_engine.adapters import (
     HTTPTenantManagementAdapter,
 )
 from user_engine.service import UserEngineService
+from user_engine.identity_state import AutheliaIdentityState
 from user_engine.oidc import OIDCClient
 from user_engine.web import PortalApplication
 from user_engine.factor_recovery import FactorRecoveryClient
@@ -118,6 +119,11 @@ def create_application() -> PortalApplication:
         registration_rate_window_seconds=int(
             os.environ.get("USER_ENGINE_REGISTRATION_RATE_WINDOW_SECONDS", "60")
         ),
+        identity_lookup=(
+            AutheliaIdentityState(os.environ["USER_ENGINE_IDENTITY_STATE_URL"])
+            if os.environ.get("USER_ENGINE_IDENTITY_STATE_URL")
+            else None
+        ),
     )
 
     from user_engine.operations_status import check_services