fix(auth): harden OIDC browser transactions

backend/test/auth-session-store.test.ts

@@ -70,7 +70,14 @@ const revision = "a".repeat(64);
 const validLocalUser = { enabled: true, authRevision: 7, roles: ["admin"] as const };
 
 function oidcInput(nonce: string, codeVerifier: string) {
-  return { nonce, codeVerifier, returnTo: "/" as const, authConfigRevision: revision, issuer: "https://issuer.example.test" };
+  return {
+    nonce,
+    codeVerifier,
+    returnTo: "/" as const,
+    authConfigRevision: revision,
+    issuer: "https://issuer.example.test",
+    browserTransactionDigest: "b".repeat(64),
+  };
 }
 
 afterEach(() => {
@@ -285,6 +292,7 @@ describe("file-backed auth session store", () => {
       .resolves.toMatchObject({
         nonce: "n".repeat(43), codeVerifier: "v".repeat(43), returnTo: "/",
         authConfigRevision: revision, issuer: "https://issuer.example.test",
+        browserTransactionDigest: "b".repeat(64),
       });
     await expect(store.consumeOidcState(created.state)).resolves.toBeUndefined();