Try SSO silently on an anonymous visit when FLEET_OIDC_AUTO_START is set

[jzhao234]

What changed, and why

With FLEET_OIDC_AUTO_START=1, a browser that opens Fleet without a session is sent to the identity provider first with a silent check (OIDC prompt=none). If it already has a central session it lands in Fleet without clicking anything; if not, it comes back to Fleet's normal login card with the SSO button and the password form, no error shown. The card, and with it the local admin password, stays one URL away (/login?manual=1), so nothing about recovery when Auth is down changes.

Elcano's central Auth signs a user in once for every application; Explorer already starts SSO on any anonymous visit. Fleet could not copy that because it keeps its own email/password login as the break-glass path, and an unconditional redirect would strand a user without a central session on the IdP's password page instead of Fleet's page with both options. prompt=none is the protocol's answer: the IdP either returns a code or error=login_required, and Fleet decides what to render.

• getOidcConfig gains autoStart (FLEET_OIDC_AUTO_START, off by default); shouldAutoStartLogin(params, config) is the one decision point.
• /api/auth/oidc/start?silent=1 adds prompt=none to the authorize request; everything else about the request is unchanged.
• The callback maps error=login_required and error=interaction_required to a 303 to /login?sso=none with the temp cookies cleared: no banner, and the sso=none marker stops the page from auto-starting again. Every other IdP error keeps the existing oidc_denied handling.
• /login (server component) reads its search params and, when auto-start is on and the visit carries no ?e=, no ?sso=none and no ?manual=1, redirects to the silent start. The prop is optional so callers that render the page without params are unchanged.
• Docs: DEPLOYMENT.md lists the flag; central-auth-integration.md describes the flow and notes that Auth supports prompt=none from 1521760+ (ElcanoTek/auth#35); an older Auth ignores the parameter and shows its own login form, a degradation, not a failure.

How you verified it

• Vitest: 61 tests across the oidc lib, start and callback routes and the login page pass, including new ones: flag parsing and shouldAutoStartLogin cases; silent start adds prompt=none and a plain start does not; login_required / interaction_required → /login?sso=none with cookies cleared and no session minted; the page redirects to /api/auth/oidc/start?silent=1 on a plain visit with the flag set, renders the card with both options for ?sso=none, ?manual=1 and ?e=, and never auto-starts with the flag off.
• npm run lint (oxlint) and npm run typecheck (tsc) clean. npm run build and the Playwright suites left to CI.

Scope and deviations

Opt-in flag only; default behaviour is unchanged. No ADR: no invariant is touched (login still goes through the same routes, cookies and membership check). The user guides do not describe the login card, so none needed updating. Deferred: replacing AUTH_SIGNING_PUBKEY as the legacy magic-link toggle with an explicit flag (separate change).

---

• The title and "What changed, and why" are written for the release notes they become
• A design note added, if this ships a feature (docs/features/central-auth-integration.md updated)
• An ADR added or superseded, if this adds, weakens or reverses an invariant (none touched)
• The diff is scoped to one change