fix(auth): isolate bounded OIDC cleanup

backend/src/auth/oidc-client.ts

@@ -173,7 +173,7 @@ async function readWithAbort(
   signal.throwIfAborted();
   return await new Promise((resolve, reject) => {
     const aborted = () => {
-      void reader.cancel().catch(() => undefined);
+      cancelReaderBestEffort(reader);
       reject(signal.reason);
     };
     signal.addEventListener("abort", aborted, { once: true });
@@ -181,6 +181,14 @@ async function readWithAbort(
   });
 }
 
+function cancelReaderBestEffort(reader: ReadableStreamDefaultReader<Uint8Array>): void {
+  try {
+    void reader.cancel().catch(() => undefined);
+  } catch {
+    // Cancellation is advisory; the bounded fetch timeout/rejection remains authoritative.
+  }
+}
+
 async function boundedJwksBody(response: Response, signal: AbortSignal): Promise<string> {
   if (!response.body) throw new OidcProtocolError();
   const reader = response.body.getReader();
@@ -204,8 +212,11 @@ async function boundedJwksBody(response: Response, signal: AbortSignal): Promise
     }
     completed = true;
   } finally {
-    if (!completed) await reader.cancel().catch(() => undefined);
-    try { reader.releaseLock(); } catch { /* cancellation already made the response unusable */ }
+    try {
+      if (!completed) cancelReaderBestEffort(reader);
+    } finally {
+      try { reader.releaseLock(); } catch { /* cancellation already made the response unusable */ }
+    }
   }
   signal.throwIfAborted();
   try {