fix(auth): isolate bounded OIDC cleanup

backend/test/oidc-client.test.ts

@@ -241,6 +241,51 @@ test("cancels and releases a non-success JWKS response body", async () => {
   expect(body.locked).toBe(false);
 });
 
+test("rejects promptly and releases the JWKS reader when stream cancellation never settles", async () => {
+  let cancelled = false;
+  const body = new ReadableStream({
+    pull() { /* a non-success response is rejected before any body read */ },
+    cancel() {
+      cancelled = true;
+      return new Promise<void>(() => { /* deliberately never settles */ });
+    },
+  });
+  const subject = protocol({ jwksResponse: () => new Response(body, { status: 503 }) });
+  const completion = callback(subject).then(() => "resolved" as const, () => "rejected" as const);
+  const outcome = await Promise.race([
+    completion,
+    new Promise<"timed-out">((resolve) => setTimeout(() => resolve("timed-out"), 100)),
+  ]);
+
+  expect(outcome).toBe("rejected");
+  expect(cancelled).toBe(true);
+  expect(body.locked).toBe(false);
+});
+
+test("preserves the JWKS body timeout when cancellation never settles", async () => {
+  let cancelled = false;
+  const body = new ReadableStream({
+    pull() { return new Promise<void>(() => { /* body read deliberately hangs */ }); },
+    cancel() {
+      cancelled = true;
+      return new Promise<void>(() => { /* deliberately never settles */ });
+    },
+  });
+  const subject = protocol({
+    jwksTimeoutMs: 20,
+    jwksResponse: () => new Response(body),
+  });
+  const completion = callback(subject).then(() => "resolved" as const, () => "rejected" as const);
+  const outcome = await Promise.race([
+    completion,
+    new Promise<"timed-out">((resolve) => setTimeout(() => resolve("timed-out"), 100)),
+  ]);
+
+  expect(outcome).toBe("rejected");
+  expect(cancelled).toBe(true);
+  expect(body.locked).toBe(false);
+});
+
 test("stops streaming a JWKS response as soon as the byte limit is exceeded", async () => {
   let pulls = 0;
   let cancelled = false;