fix(auth): move forced-mfa-setup page out of /auth/ to escape proxy catch-all

The /auth/[...path]/route.ts catch-all in the Next.js frontend
proxies *every* /auth/* request to the backend, including the
forced-mfa-setup page route. Backend has no GET endpoint for that
path → 404 → page never serves → user sees blank or bounces back
to /login.

Move the page to /mfa-setup (outside /auth/) and update redirects:
- login page.tsx redirect
- OIDC + SAML callback redirects

.claude/launch.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "logo-preview",
+      "runtimeExecutable": "python3",
+      "runtimeArgs": ["-m", "http.server", "8765", "--directory", "/tmp/logo-preview"],
+      "port": 8765
+    }
+  ]
+}

app/routers/auth_oidc.py

@@ -315,7 +315,7 @@ async def oidc_callback(
         )
         base = os.getenv("DASHBOARD_URL", "/").rstrip("/")
         return RedirectResponse(
-            f"{base}/auth/forced-mfa-setup?token={setup_token}",
+            f"{base}/mfa-setup?token={setup_token}",
             status_code=302,
         )
 

app/routers/auth_saml.py

@@ -202,7 +202,7 @@ async def saml_acs(request: Request, db: Session = Depends(get_db)):
         import os as _os
         base = _os.getenv("DASHBOARD_URL", "/").rstrip("/")
         return RedirectResponse(
-            f"{base}/auth/forced-mfa-setup?token={setup_token}",
+            f"{base}/mfa-setup?token={setup_token}",
             status_code=302,
         )
 

frontend/app/login/page.tsx

@@ -45,7 +45,7 @@ export default function LoginPage() {
             // dedicated /auth/forced-mfa-setup page carrying the setup
             // token. User cannot get a session before completing it.
             if (response.data?.mfa_setup_required && response.data?.setup_token) {
-                window.location.href = `/auth/forced-mfa-setup?token=${encodeURIComponent(response.data.setup_token)}`;
+                window.location.href = `/mfa-setup?token=${encodeURIComponent(response.data.setup_token)}`;
                 return;
             }