feat(auth): include authentication in workspace and tht diagnostics

backend/src/app.ts

@@ -16,6 +16,8 @@ import { AuthSessionOperationalError, createFileAuthSessionStore, type AuthSessi
 import type { WindowsAuthStorageBridge } from "./auth/windows-auth-storage.js";
 import { registerAuthRoutes } from "./auth/routes.js";
 import { createOidcProtocol, type OidcProtocol, type OidcProtocolOptions } from "./auth/oidc-client.js";
+import { createConfiguredAuthDiagnoser } from "./auth/diagnostic-command.js";
+import type { AuthDiagnoser } from "./auth/diagnostics.js";
 import { isUsableAuthenticationSecret } from "./auth/secret-policy.js";
 import { secretValue } from "./config/secret-bundle.js";
 import { sessionRoutes } from "./routes/sessions.js";
@@ -55,6 +57,7 @@ export interface BuildAppDeps {
   /** Explicit test-only transport seam; production always invokes the hidden tht bridge. */
   authStorageBridgeForTest?: WindowsAuthStorageBridge;
   oidcProtocol?: OidcProtocol;
+  authDiagnoser?: AuthDiagnoser;
   /** Explicit test seam; production uses the provider-neutral OIDC constructor. */
   oidcProtocolFactory?: (options: OidcProtocolOptions) => OidcProtocol;
 }
@@ -219,6 +222,10 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
       return undefined;
     }
   };
+  const authDiagnoser = deps?.authDiagnoser ?? createConfiguredAuthDiagnoser(config, {
+    localUserRegistry: resolveLocalUserRegistry,
+    oidcProtocol: resolveOidcProtocol,
+  });
   const authSessionStore = deps?.authSessionStore ?? (config.authMode === "local" || config.authMode === "oidc"
     ? createFileAuthSessionStore(config.authStateRoot, {
       currentAuthConfigRevision: () => {
@@ -324,6 +331,7 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
     registry: workspaceRegistry,
     config: config.workspaceRegistry,
     diagnose: workspaceDiagnoser,
+    authDiagnoser,
     secretStore: workspaceSecretStore,
   });
   settingsRoutes(app, { cfg: config, listModels, getSettings });