webadmin admin login implemented (OIDC client flow)

  • The admin console completes the OIDC login loop through a BFF: session cookie + anti-forgery token + token refresh to keep the identity alive.
  • Decision record: 2026-09-18-webadmin-oidc-login.