feat(auth): add generic OIDC login with mandatory groups

frontend/src/shell/SteerInput.test.tsx

@@ -113,6 +113,38 @@ test("a delayed steer from user A cannot mutate user B's store or composer", asy
   view.unmount();
 });
 
+test("a held steer for s1 cannot complete into the active s2 operation scope", async () => {
+  let release!: () => void;
+  let started!: () => void;
+  let settled!: () => void;
+  const held = new Promise<void>((resolve) => { release = resolve; });
+  const requestStarted = new Promise<void>((resolve) => { started = resolve; });
+  const requestSettled = new Promise<void>((resolve) => { settled = resolve; });
+  server.use(http.post("/api/sessions/s1/steer", async () => {
+    started();
+    try {
+      await held;
+      return new HttpResponse(null, { status: 204 });
+    } finally {
+      settled();
+    }
+  }));
+
+  const view = render(<SteerInput sessionId="s1" />);
+  const input = screen.getByRole("textbox");
+  await userEvent.type(input, "Keep s1 isolated");
+  await userEvent.click(screen.getByRole("button", { name: /invia|send|steer/i }));
+  await requestStarted;
+
+  view.rerender(<SteerInput sessionId="s2" />);
+  act(() => useSessionStore.getState().setLastUserEntry({ kind: "input", text: "s2 owned" }));
+  release();
+  await act(async () => { await requestSettled; });
+
+  expect(useSessionStore.getState().lastUserEntry).toEqual({ kind: "input", text: "s2 owned" });
+  expect(input).toHaveValue("Keep s1 isolated");
+});
+
 test("a settings preflight from user A prevents session POST after user B logs in", async () => {
   let releaseSettings!: () => void;
   let settingsStarted!: () => void;