fix(auth): harden unified diagnostic execution

frontend/src/shell/WorkspaceManager.test.tsx

@@ -250,6 +250,29 @@ test("renders one authentication section with configured-group errors and no unm
   expect(within(section).queryByText(/unmapped/i)).not.toBeInTheDocument();
 });
 
+test("never renders a hostile authentication field rejected by the API decoder", async () => {
+  const user = userEvent.setup();
+  const attacker = "attacker-field-SENTINEL";
+  server.use(http.post("/api/workspaces/validate", () => HttpResponse.json({
+    workspace,
+    contract: {},
+    activatable: false,
+    diagnostics: [],
+    authentication: {
+      ready: false,
+      mode: "oidc",
+      checks: [{ level: "error", code: "oidc_secret_missing", message: "failure", field: attacker }],
+    },
+  })));
+  renderManager();
+  await user.click(await screen.findByRole("button", { name: "PSD Clinical" }));
+
+  await user.click(screen.getByRole("button", { name: "Validate workspace source" }));
+
+  expect(await screen.findByRole("alert")).toBeVisible();
+  expect(screen.queryByText(new RegExp(attacker))).not.toBeInTheDocument();
+});
+
 test("renders binding_ok as a green connection success", async () => {
   const user = userEvent.setup();
   server.use(

frontend/src/shell/WorkspaceManager.tsx

@@ -492,7 +492,7 @@ export function WorkspaceManager({
                           {authentication.ready ? "Passed" : "Failed"}
                         </span>
                       </div>
-                      {!authentication.ready && <div role="alert" className="mt-3 grid gap-1 rounded-md border border-amber-500/30 bg-amber-500/10 px-3 py-2 text-sm">
+                      {authentication.checks.some(({ level }) => level === "error") && <div role="alert" className="mt-3 grid gap-1 rounded-md border border-amber-500/30 bg-amber-500/10 px-3 py-2 text-sm">
                         {authentication.checks.filter(({ level }) => level === "error").map(({ code, field, message }) => (
                           <p key={`${code}:${field ?? ""}`} className="flex items-start gap-2">
                             <AlertCircle className="mt-0.5 size-4 shrink-0 text-amber-700" />