fix(auth): make diagnostics bounded and portable

backend/src/app.ts

@@ -15,6 +15,7 @@ import { createCurrentLocalUserRegistryResolver, type LocalUserRegistry } from "
 import { AuthSessionOperationalError, createFileAuthSessionStore, type AuthSessionStore, type AuthSessionValidity } from "./auth/session-store.js";
 import { registerAuthRoutes } from "./auth/routes.js";
 import { createOidcProtocol, type OidcProtocol } from "./auth/oidc-client.js";
+import { isUsableAuthenticationSecret } from "./auth/secret-policy.js";
 import { sessionRoutes } from "./routes/sessions.js";
 import { sqlRoutes } from "./routes/sql.js";
 import { metaRoutes, type ListModelsFn } from "./routes/meta.js";
@@ -198,7 +199,7 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
     if (deps?.oidcProtocol) return deps.oidcProtocol;
     if (loaded.value.mode !== "oidc") return undefined;
     const clientSecret = process.env.THT_OIDC_CLIENT_SECRET;
-    if (typeof clientSecret !== "string" || clientSecret.length === 0 || clientSecret.length > 4096 || /\p{Cc}/u.test(clientSecret)) {
+    if (!isUsableAuthenticationSecret("THT_OIDC_CLIENT_SECRET", clientSecret)) {
       return undefined;
     }
     try {