feat(auth): add generic OIDC login with mandatory groups

frontend/src/shell/WidgetHost.tsx

@@ -15,6 +15,12 @@ export function WidgetHost({ sessionId }: { sessionId: string | null }) {
   const responseInFlight = useRef(false);
   const operationEpochRef = useRef(0);
   useEffect(() => () => { operationEpochRef.current += 1; }, []);
+  useEffect(() => {
+    // A gate belongs to its active session target, not merely the authenticated user.
+    operationEpochRef.current += 1;
+    responseInFlight.current = false;
+    setResponding(false);
+  }, [sessionId]);
   if (!pending) return null;
   const Renderer = resolve(pending.widget);
   const onRespond = async (r: UiResponse) => {