fix(auth): treat OIDC discovery 5xx as unavailable

[SebTardif]

A temporary discovery HTTP 5xx from the default OpenClaw ID issuer used to abort server startup even though ClickClack has documented fallback endpoints. Treat HTTP 500–599 as unavailable discovery, just like network failure and HTTP 404. Custom issuers still fail closed; malformed documents, redirects, client errors, and statuses outside the server-error range are rejected. Explicit endpoint overrides remain intact.

Expanded regression coverage exercises both issuer types, fallback status boundaries, rejected responses, and each endpoint override. Updated the authentication guide and Unreleased changelog. Thanks @SebTardif for the fix.

Validation: the original regression failed against main for HTTP 500, 502, and 503. The expanded discovery tests and full pnpm check passed on AWS Crabbox with Go 1.27.1, Node.js 24.19.0, and pnpm 12.7.0. Independent Codex autoreview is scoped-clean through P2. Test credential strings are inert fixtures, not live credentials. GitHub CI must pass on the updated head before merge.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review blocked

Automated review did not run, so no review verdict was produced.

Reason: The input-safety check rejected material in this revision. No detected value, path, or scanner output is reproduced here.

Automatic review is on hold, including after source changes. Request a fresh re-review after resolving the failure; maintainers can also release the hold through an intentional scanner-policy update.

Next step: If this is a genuine credential, remove and rotate it. If it is an intentional test fixture, a maintainer must review and qualify it.

View the workflow run.

[steipete]

Merged as 8ca28be. Thanks @SebTardif.

The original test reproduced default-issuer startup failures for discovery HTTP 500, 502, and 503 on main. On the finished patch, the expanded discovery tests and full pnpm check passed on AWS Crabbox (Go 1.27.1, Node.js 24.19.0, pnpm 12.7.0). Independent Codex review found no actionable P0–P2 issues.

All checks passed on exact head d852ae1: server/web/Docker/browser CI and Windows/macOS/Linux desktop CI. Custom issuers remain fail-closed, endpoint overrides are preserved, and docs/changelog now describe the fallback.