refactor(auth): move the SSO callback's account resolution and sign-in endings out of its route

src/__tests__/baselines/source-function-lines.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Production functions over 200 lines, keyed \"file :: name\", and their length. Maintained by src/__tests__/source-size-ratchet.test.ts.",
   "count": 370,
-  "total": 129150,
+  "total": 128945,
   "entries": {
     "app/achievements/page.tsx :: AchievementsPage": 206,
     "app/api/admin/backups/upload/route.ts :: apiHandler(arg)": 314,
@@ -9,7 +9,7 @@
     "app/api/admin/settings/route.ts :: apiHandler(arg) #2": 211,
     "app/api/auth/login/route.ts :: apiHandler(arg)": 262,
     "app/api/auth/me/route.ts :: apiHandler(arg)": 386,
-    "app/api/auth/oidc/callback/route.ts :: apiHandler(arg)": 499,
+    "app/api/auth/oidc/callback/route.ts :: apiHandler(arg)": 294,
     "app/api/auth/register/route.ts :: apiHandler(arg)": 268,
     "app/api/coach/about-me/route.ts :: apiHandler(arg) #2": 309,
     "app/api/cycle/calendar/route.ts :: apiHandler(arg)": 230,

src/__tests__/baselines/version-stamp-comments.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Comment lines that open with a release version, per file under src/. Maintained by src/__tests__/version-stamp-ratchet.test.ts.",
   "count": 2911,
-  "total": 9688,
+  "total": 9684,
   "entries": {
     "__tests__/account-payload-consumer-guard.test.ts": 2,
     "__tests__/acting-account-boundary-guard.test.ts": 7,
@@ -163,7 +163,7 @@
     "app/api/auth/mfa/verify/route.ts": 1,
     "app/api/auth/mfa/webauthn/verify/route.ts": 1,
     "app/api/auth/oidc/callback/__tests__/route.test.ts": 1,
-    "app/api/auth/oidc/callback/route.ts": 7,
+    "app/api/auth/oidc/callback/route.ts": 3,
     "app/api/auth/oidc/login/route.ts": 2,
     "app/api/auth/passkey/login-options/route.ts": 1,
     "app/api/auth/passkey/login-verify/__tests__/native-token.test.ts": 2,

src/__tests__/oidc-native-error-reasons-documented.test.ts

@@ -37,10 +37,13 @@ describe("native OIDC error reasons are documented", () => {
   // The login route answers both legs through `loginError`; the callback's
   // native-aware helper is `failRedirect`. `errorRedirect` in the callback is
   // the browser-only branch taken before the state (and so the native flag)
-  // could be read, and never reaches the app.
+  // could be read, and never reaches the app. The account resolution the
+  // callback calls names its refusals through `refuse`, and the callback
+  // hands each one to `failRedirect`.
   const sent = new Set([
     ...reasons(read("app/api/auth/oidc/login/route.ts"), ["loginError"]),
     ...reasons(read("app/api/auth/oidc/callback/route.ts"), ["failRedirect"]),
+    ...reasons(read("lib/auth/oidc-callback/resolve-account.ts"), ["refuse"]),
   ]);
 
   // The login route's 302 description is one string literal on one line.