fix(keycloak): capture the interstitial that screen 07's evidence never showed - #316

Closes #301 (the interstitial half — see "The deck half" below).

The problem

qa-shots/hifi/07-keycloak-login-{desktop,phone}.png were byte-identical to the 07-keycloak-loggedout pair — two screens claiming to be different and both showing the second:

2e740601cc412d1ea52c447ce702d44a  07-keycloak-loggedout-desktop.png
2e740601cc412d1ea52c447ce702d44a  07-keycloak-login-desktop.png     ← same file

Keycloak/Login calls window.location.assign('/api/keycloak/auth/login') from a mount effect, so the capture followed the redirect and screenshotted wherever it landed.

The decision: keep it invisible, fix the evidence

The interstitial stays exactly as it is. In a working install it is painted for the length of one navigation and no longer, and adding a pause so the branded card can be admired would tax every Keycloak sign-in for a screen nobody asked to see. It is not dead weight either — it is what a visitor is left looking at when the realm is unreachable or JavaScript is off, and its manual link is the only way forward from there.

Capturing it

scripts/shoot_keycloak_interstitial.py holds the page by answering /api/keycloak/auth/login with a 204, which a browser declines to navigate to.

Two things I got wrong first, both now in the script's docstring so nobody repeats them:

• route.abort() does not work. This is a top-level navigation, so aborting lands the browser on chrome-error://chromewebdata/ and screenshots a blank error page — a second way to produce evidence of the wrong screen. Verified: URL: chrome-error://chromewebdata/, empty body.
• The screen does not exist under the default dev config. With users as the active provider, AuthMiddleware 302s /keycloak/login → /users/login. The server must be booted with SM_AUTH_PROVIDER=keycloak plus a realm. That is why this was never capturable by the general shots script.

Both screenshots are regenerated and now show the real card — icon tile, "Redirecting to your identity provider", https://sso.example.com/realms/acme, indeterminate bar, manual link — at 1440 and 390.

And a test, because a screenshot is weak evidence

Nothing tested this component. modules/keycloak/tests-js/Login.test.tsx (5 tests) pins what survives when the redirect does not happen: the realm named when configured, nothing claimed when it is not, the manual link's target, the progress bar staying indeterminate, and the mount-effect redirect itself.

Spec

Screen 07 is recorded under Deliberate departures as a transient state and the no-JS fallback. I also corrected a stale line in the same table: it said the legacy-session fail-open "is temporary" — that closed in #292.

Verification

• uv run pytest -q — 2914 passed, 60 deselected
• npx vitest run — 417 passed in 49 files (5 new)
• npx biome check, npx tsc -p modules/keycloak --noEmit, check_untranslated_strings.mjs, ruff check scripts, check_file_size.py — all pass
• Screenshots inspected visually, not just diffed by hash.

The deck half of #301 is NOT done

The other bullet — re-verifying all 28 screens against the current Hi-Fi Pages.dc.html (project 4ad8fe06-…) rather than the 2026-08-19 cached export — I could not do. The deck is not in this repo and I have no access to the live design file. The Figma connector in this session is unauthorised, and #313's author independently hit the same wall (their 46/48px figures came from the repo's own gap-analysis notes, not the deck).

That bullet needs someone with access to the file. I'd suggest keeping #301 open for it, or splitting it into its own issue so this half can close.