fix(frontend): hide logout outside local auth

frontend/src/App.test.tsx

@@ -3,13 +3,50 @@ import { http, HttpResponse } from "msw";
 import { server } from "./test/msw";
 import { App } from "./App";
 
-test("App renders the shell with create affordance after authentication", async () => {
+function registerAuthenticatedShell(mode: "local" | "upstream") {
   server.use(
-    http.get("/api/settings", () => HttpResponse.json({ workspace: "psd", provider: "zai", model: "glm-5.2", thinking: "medium" })),
+    http.get("/api/auth/config", () => HttpResponse.json({
+      mode,
+      localLogin: mode === "local",
+      oidcLogin: false,
+    })),
+    http.get("/api/me", () => HttpResponse.json({
+      issuer: mode === "local" ? "local" : "portal",
+      subject: "portal-user",
+      displayName: "Portal user",
+      roles: ["user"],
+      permissions: ["session.use"],
+      isAdmin: false,
+      csrfToken: mode === "local" ? "c".repeat(43) : null,
+      session: null,
+    })),
+    http.get("/api/settings", () => HttpResponse.json({
+      workspace: "psd", provider: "zai", model: "glm-5.2", thinking: "medium",
+    })),
     http.get("/api/workspaces", () => HttpResponse.json([])),
     http.get("/api/models", () => HttpResponse.json({ models: [] })),
     http.get("/api/sessions", () => HttpResponse.json([])),
+    http.get("/api/workspace-registry/status", () => HttpResponse.json({
+      branch: "main", ahead: 0, behind: 0, degraded: false,
+    })),
   );
+}
+
+test("local authentication renders the standalone logout control", async () => {
+  registerAuthenticatedShell("local");
+
   render(<App />);
-  expect(await screen.findByRole("button", { name: /new/i })).toBeInTheDocument();
+
+  expect(await screen.findByRole("button", { name: "New session" })).toBeInTheDocument();
+  expect(screen.getByText("Portal user")).toBeInTheDocument();
+  expect(screen.getByRole("button", { name: "Log out" })).toBeInTheDocument();
+});
+
+test("trusted upstream authentication keeps identity but omits ThothII logout", async () => {
+  registerAuthenticatedShell("upstream");
+
+  render(<App />);
+
+  expect(await screen.findByText("Portal user")).toBeInTheDocument();
+  expect(screen.queryByRole("button", { name: "Log out" })).not.toBeInTheDocument();
 });