rework

STATUS.md

@@ -1,5 +1,27 @@
 # fancy-dns — development status and continuation plan
 
+## Console authentication update
+
+OIDC login now starts automatically, with server-owned state and PKCE. Go
+exchanges the authorization code, verifies the access token, and stores it in
+an in-memory session addressed by a Secure, HttpOnly, SameSite=Lax cookie.
+Cookie mutations require an exact configured console Origin. Sessions reverify
+the access token and cannot outlive its signed expiry. Logout revokes the local
+session and offers an explicit sign-in button rather than immediately logging
+back in. API keys and bearer tokens remain available for machine clients.
+`api.auth.oidc_redirect_uri` names the registered HTTPS callback; when omitted,
+an HTTPS audience supplies the origin with `/auth/oidc/callback`. The current
+AuthClient already registers that callback, so provider CORS changes are no
+longer needed. Pending logins and sessions are process-local; a restart requires
+sign-in, and multiple replicas need sticky routing (as existing basic sessions do).
+No refresh token is requested; expiry starts another provider sign-in using SSO.
+
+Console cleanup removes the unused bootstrap refresh editor, hides Save when
+configuration writes are unavailable, removes script instructions from login,
+and fixes the shell's identity/read-only display by moving it inside its provider.
+Validation: `make check` passes, including race tests; frontend lint and production
+build pass with warnings. These changes have not been deployed.
+
 Last updated after the round that finished the **server shutdown paths**:
 every transport's ordering with a query in flight is now a test, and it found
 two real bugs — an idle client could hold a shutdown for the whole grace