fix(auth): harden OIDC browser transactions

backend/src/auth/session-store.ts

@@ -70,6 +70,7 @@ export interface OidcStateCreateInput {
   returnTo: "/";
   authConfigRevision: string;
   issuer: string;
+  browserTransactionDigest: string;
 }
 
 export interface CreatedOidcState {
@@ -192,6 +193,7 @@ const oidcStateRecordSchema = z.strictObject({
   returnTo: z.literal("/"),
   authConfigRevision: z.string().regex(/^[a-f0-9]{64}$/),
   issuer: z.string().min(1).max(2048).refine((value) => !/\p{Cc}/u.test(value)),
+  browserTransactionDigest: z.string().regex(/^[a-f0-9]{64}$/),
   createdAt: timestamp,
   expiresAt: timestamp,
 }).superRefine((record, context) => {
@@ -232,6 +234,7 @@ const oidcStateInputSchema = z.strictObject({
   returnTo: z.literal("/"),
   authConfigRevision: z.string().regex(/^[a-f0-9]{64}$/),
   issuer: z.string().min(1).max(2048).refine((value) => !/\p{Cc}/u.test(value)),
+  browserTransactionDigest: z.string().regex(/^[a-f0-9]{64}$/),
 });
 
 function sameFileIdentity(left: FileIdentity, right: FileIdentity): boolean {
@@ -935,6 +938,7 @@ export function createFileAuthSessionStore(
       returnTo: validated.returnTo,
       authConfigRevision: validated.authConfigRevision,
       issuer: validated.issuer,
+      browserTransactionDigest: validated.browserTransactionDigest,
       createdAt: isoAt(nowMs),
       expiresAt: isoAt(expiresMs),
     };