fix(auth): make diagnostics match runtime safety

backend/test/oidc-client.test.ts

@@ -1,6 +1,12 @@
 import { createSign, generateKeyPairSync } from "node:crypto";
 import { expect, test } from "vitest";
-import { createOidcProtocol, OidcJwksUnavailableError, OidcProtocolError, OidcProviderUnavailableError } from "../src/auth/oidc-client.js";
+import {
+  createOidcProtocol,
+  OidcIssuerMismatchError,
+  OidcJwksUnavailableError,
+  OidcProtocolError,
+  OidcProviderUnavailableError,
+} from "../src/auth/oidc-client.js";
 
 const issuer = "https://issuer.example.test";
 const clientId = "thothii";
@@ -284,8 +290,14 @@ test("rejects non-HTTPS issuer configuration and a discovery issuer mismatch", a
     issuer: "http://issuer.example.test", clientId, clientSecret: "secret", callbackUrl,
     scopes: ["openid"], groupsClaim: "groups",
   })).toThrow(OidcProtocolError);
-  await expect(protocol({ discoveryIssuer: "https://other.example.test" }).authorizationUrl({ state, nonce, codeVerifier: verifier }))
-    .rejects.toThrow(OidcProtocolError);
+  try {
+    await protocol({ discoveryIssuer: "https://other.example.test" })
+      .authorizationUrl({ state, nonce, codeVerifier: verifier });
+    throw new Error("issuer mismatch unexpectedly accepted");
+  } catch (error) {
+    expect(error).toBeInstanceOf(OidcIssuerMismatchError);
+    expect((error as Error).message).toBe("oidc_issuer_mismatch");
+  }
 });
 
 test.each([