- Register app.get('/api/login', redirect to '/') in protected-routes block - Route placed after OIDC guard so unauthenticated nav triggers auth flow - Add login.test.ts covering bypass and OIDC-passthrough redirect paths
