[LeeO86]

Changes

Corporate users can opt into server-side silent OIDC sign-in before the portal renders. Failed attempts return to public viewing with a retry cookie; signing out suppresses automatic sign-in until explicit login or browser-session end. Provider-first login, safe return paths, friendly errors, display names and the effective role/authentication method make the current account visible. Existing installations keep automatic sign-in disabled.

Sidebar facets now count each namespace without its own terms while retaining other filters and visibility restrictions. A normal click switches a single selected value in one step; Shift/Alt retain OR/NOT, selected values appear first, and typed complex queries keep their existing count behaviour. Fixes #46.

Application and collection versions are 2.4.0. The additive display-name migration preserves existing data and old backups. Configuration, provider setup, API/OpenAPI and sidebar documentation are updated.

Validation

• 176 app/unit/HTTP tests, including a local HTTPS mock OIDC provider, real expired sealed sessions, provider/discovery/exchange failures, suppression, return-path validation and facet visibility.
• 20 browser tests, including automatic sign-in for Viewer/Editor/Admin, anonymous fallback, break-glass access, account menu and one-click group switching.
• Lint, typecheck, production build, Ansible sanity and 13 Python tests pass.
• Production server passes all 33 automation smoke assertions using disposable synthetic data.
• CI verifies offline assets, the unchanged Ansible integration and release images before publishing.