USER-WP-0039: show account-site and Authelia uid on the account page (NK-WP-0051-T03)

The Identity section now names both session uids on separate lines and
marks a mismatch, using the existing server-side Authelia /api/state
lookup. Unknown Authelia uid reads 'not signed in / unknown'.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52

workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md

@@ -0,0 +1,61 @@
+---
+id: USER-WP-0039
+type: workplan
+title: "Sign-in diagnosis: account-site and Authelia uid on the account page"
+domain: communication
+repo: user-engine
+status: active
+owner: claude
+topic_slug: communication
+created: "2026-10-14"
+updated: "2026-10-14"
+related:
+  - NK-WP-0051-T03
+  - USER-WP-0036
+---
+
+# Sign-in diagnosis: two session uids
+
+Owner side of NetKingdom NK-WP-0051-T03. Contract:
+`net-kingdom/docs/sign-in-diagnosis.md` (only source of field names and the
+never-show list).
+
+Problem: `users.coulomb.social` stayed signed in as `bernd.worsch-3` while
+`bao login` reused a different Authelia session, and nothing showed the
+mismatch.
+
+Approach: reuse the existing server-side Authelia `/api/state` lookup
+(`identity_state.AutheliaIdentityState`, already configured in
+rapp-user-engine via `USER_ENGINE_IDENTITY_STATE_URL` /
+`USER_ENGINE_IDENTITY_STATE_HOST`). The account site already receives the
+`authelia_session` cookie because Authelia's cookie domain is
+`coulomb.social`; no ingress, forward-auth, or cookie-domain change is
+needed. The account-site session is unchanged.
+
+## Show both session uids and mark a mismatch
+
+```task
+id: USER-WP-0039-T01
+status: done
+priority: high
+```
+
+The Identity section on `/` and `/onboarding` shows two labelled lines:
+account-site session `uid` and Authelia session `uid`. When they differ a
+`role="alert"` marker names both and links the shared-sign-in logout. When
+the Authelia uid is unavailable it reads "not signed in / unknown". Only
+the two uids are rendered; no email, token, cookie, or OTP. Tests in
+`tests/test_account_identity_disclosure.py`.
+
+## Deploy and record evidence for NK-WP-0051
+
+```task
+id: USER-WP-0039-T02
+status: todo
+priority: high
+```
+
+Build and roll the image through rapp-user-engine (no manifest change
+needed), check the two lines on `users.coulomb.social` with a mismatched
+session, and report the image digest to net-kingdom for the contract's
+evidence table (`user-engine change`).