fix(19): BL-04 keep context oidcIss/oidcSub null for local users (no fabricated identity sentinels)

apps/api/tests/auth/localAuthMiddleware.test.ts

@@ -155,6 +155,36 @@ describe('localAuthMiddleware', () => {
     expect(u.color).toBe('#FF5733');
   });
 
+  it('Test 1c (BL-04): local user with null DB oidc fields → context oidcIss/oidcSub are NULL (no fabricated sentinels)', async () => {
+    mockVerifyResult = 9;
+    mockDbSelectResult.push({
+      id: 9,
+      oidcIss: null, // local user — no OIDC identity bound
+      oidcSub: null,
+      displayName: 'Local Member',
+      color: '#22AA88',
+    });
+
+    const localAuthMiddleware = await getMiddleware();
+    const app = new Hono();
+    let capturedUser: unknown;
+
+    app.use('/api/*', localAuthMiddleware());
+    app.get('/api/test', (c) => {
+      capturedUser = c.get('user');
+      return c.json({ ok: true });
+    });
+
+    const res = await app.request('/api/test');
+    expect(res.status).toBe(200);
+    const u = capturedUser as { id: number; oidcIss: string | null; oidcSub: string | null };
+    expect(u.id).toBe(9);
+    // BL-04: must be null — NOT 'local' / String(id) sentinels that share the
+    // uniq_oidc_identity domain with real OIDC identities.
+    expect(u.oidcIss).toBeNull();
+    expect(u.oidcSub).toBeNull();
+  });
+
   it('Test 2: no cookie → pure passthrough; c.get("user") remains unset (Pitfall-1 guard)', async () => {
     mockVerifyResult = null; // No cookie / invalid