[VargaJoe]

Late authentication responses could restore a signed-out identity, clear a newer session, or leave AdminUI on a blank/loading screen. This follow-up to merged #1655 fixes those paths across IdentityServer, SNAuth and Local authentication.

• Local: share repository/issuer lifecycle and refresh state across remounts; guard old logout/login/current-user results and delayed 401 retries.
• OIDC: remove exact event subscriptions, provide failure recovery, and stage silent/explicit callback results before serialized user-store commits so old responses cannot overwrite logout or a new identity. Use public UserManager APIs, shared metadata/state stores, single-flight renewal and child timer cleanup.
• SNAuth: clear locally immediately with bounded server revocation; guard stale operations; bind external login to expiring, one-use tab-local state and S256 proof. Route callbacks to their bound repository/config despite another tab changing the global mode or repository.
• Provider switching: treat IdentityServer/SNAuth discovery as a normal handoff. Clear the old selection before creating the next login intent, so the first IS-to-SNAuth attempt is not cancelled. Ignore older discovery success/failure after a newer selection or unmount.
• Silent callbacks: handle the exact OIDC iframe callback before mounting application providers. The public signinSilentCallback method notifies the initiating window without repository discovery or session initialization, including when another tab selected SNAuth/Local. Parent origin/source/state/proof checks remain intact.

The existing bare-root repository restoration policy is preserved. Explicit external selection persists its authentication mode. No new container configuration is required.

Deploy the upgraded SNAuth server from SenseNet/sn-auth#14 BEFORE deploying this client. Server14 is merged; its published image was used in the local acceptance. New clients reject older unbound SNAuth callbacks; the upgraded server still supports legacy clients. This PR does not publish a package version or deploy a remote server.

Validation of latest change ae03d4c:

• 127/127 focused authentication regressions; original provider code fails all6 new handoff/stale-discovery cases, and the original bootstrap fails the3 new mixed-mode silent callback cases.
• Independent reviews of provider handoff and early callback: no merge blocker. Scoped TypeScript, ESLint/Prettier and commit hooks passed; existing hook warnings remain in the SNAuth wrapper.
• Both IdentityServer and SNAuth production builds succeeded with existing asset-size/Browserslist warnings.
• Actual trusted-TLS local HTTP acceptance: IdentityServer4/4 groups, upgraded SNAuth+repository9/9, Local8/8. Covers actual code/S256 exchange, legacy compatibility, authenticated repository identity, refresh rotation, revocation and independent sessions.
• Actual isolated Chrome UI acceptance without network mocks: IS login/reload/logout to picker, first-attempt IS-to-SNAuth login/reload/logout, reverse SNAuth-to-IS, and Local login/reload/logout/repository selection. No incompatible-server message on supported switching.
• Actual Chrome iframe probe: before fix, global Local mode failed to notify its parent within20s; after fix Local notified in2093ms and SNAuth in386ms. Unit regressions also cover unchanged global state and no network/store/bootstrap work.

The earlier full-monorepo preview workflow failed in unchanged sn-pickers-react type/dependency inputs (missing @material-ui/lab TreeItem/TreeView); no picker, dependency-manifest, lockfile or workflow change is included here. The Docker workflow builds the AdminUI directly from source aliases. See apps/sensenet/AUTHENTICATION-TESTING.md for acceptance cases.

Local acceptance is complete for the covered cases. Merge and remote deployment remain owner-controlled; verify the target SNAuth runtime is upgraded before the new AdminUI image is rolled out.