Close the login loop end-to-end: client_id is the app actor uri, actor path serves the OIDC client document via a boot-safe service, startup heals the access-need-group link, stack aligned on pod provider v2.3.12

src/app/auth/activityPodsAuth.test.ts

@@ -13,23 +13,23 @@ test('clientId uses explicit backendClientId when set', () => {
   expect(cfg.redirectUri).toBe('http://localhost:3000/login');
 });
 
-test('clientId derives from backendUrl when backendClientId is empty', () => {
+test('clientId derives the actor uri from backendUrl when backendClientId is empty', () => {
   setRuntimeConfig({ backendUrl: 'http://localhost:3003', backendClientId: '' });
   const cfg = resolveActivityPodsAuthConfig('http://localhost:5000');
-  expect(cfg.clientId).toBe('http://localhost:3003/app');
+  expect(cfg.clientId).toBe('http://localhost:3003/as/actor/app');
   expect(cfg.redirectUri).toBe('http://localhost:5000/login');
 });
 
-test('clientId falls back to origin/app when nothing is configured', () => {
+test('clientId falls back to the origin actor uri when nothing is configured', () => {
   setRuntimeConfig({});
   const cfg = resolveActivityPodsAuthConfig('http://localhost:5000');
-  expect(cfg.clientId).toBe('http://localhost:5000/app');
+  expect(cfg.clientId).toBe('http://localhost:5000/as/actor/app');
 });
 
 test('clientId does not double the slash on a trailing-slash backendUrl', () => {
   setRuntimeConfig({ backendUrl: 'http://localhost:3003/' });
   const cfg = resolveActivityPodsAuthConfig('http://localhost:5000');
-  expect(cfg.clientId).toBe('http://localhost:3003/app');
+  expect(cfg.clientId).toBe('http://localhost:3003/as/actor/app');
 });
 
 test('podProviderUrl is passed through when set', () => {
@@ -45,7 +45,7 @@ test('whitespace-only runtime values are treated as empty', () => {
     podProviderUrl: '  ',
   });
   const cfg = resolveActivityPodsAuthConfig('http://localhost:5000');
-  expect(cfg.clientId).toBe('http://localhost:5000/app');
+  expect(cfg.clientId).toBe('http://localhost:5000/as/actor/app');
   expect(cfg.podProviderUrl).toBeUndefined();
 });