fix(oidc-provider): surface federation failures as actionable errors, not opaque 500s

[alukach]

Problem

Every backend-federation failure collapsed into ProxyError::Internal, so the proxy returned a generic 500 InternalError / "Internal server error" regardless of cause, with the real reason discarded — both from the response and from logs. We hit this repeatedly while debugging the federated-test smoke test: a key/issuer mismatch (AWS STS InvalidIdentityToken) was indistinguishable from an actual proxy crash.

Root cause (crates/oidc-provider/src/lib.rs):

impl From<OidcProviderError> for ProxyError {
    fn from(e: OidcProviderError) -> Self {
        ProxyError::Internal(e.to_string())   // every variant -> 500, detail dropped
    }
}

Change

Map each federation failure to a status that reflects whose problem it is, and log the full (possibly ARN-bearing) provider detail at the conversion site — the last place it's available and somewhere it must not reach the caller:

Cause	Before	After
STS rejection (InvalidIdentityToken, …)	500 InternalError	502 BackendAuthenticationFailed
STS AccessDenied (trust policy / perms)	500 InternalError	403 AccessDenied
Bad OIDC_PROVIDER_KEY / signing failure	500 InternalError	502 (cause logged)
Broker unreachable / unparseable reply	500 InternalError	503 ServiceUnavailable

Adds ProxyError::BackendAuthError, which carries the provider error code only (e.g. InvalidIdentityToken) — safe to surface; the raw message is logged via tracing::error!, never returned. With the worker's console subscriber, wrangler tail now shows the actual STS code + message instead of nothing.

Tests

Unit tests for every mapping (crates/oidc-provider/src/lib.rs, crates/core/src/error.rs): each asserts the expected status, that it is not an opaque 500, and that the raw provider message does not leak into safe_message().

Verified locally with the CI command set: cargo check, cargo clippy -- -D warnings, cargo test, and cargo check -p multistore-cf-workers --target wasm32-unknown-unknown — all green.

🤖 Generated with Claude Code

[github-actions]

📖 Docs preview deployed to https://multistore-docs-pr-66.development-seed.workers.dev

• Date: 2026-06-04T04:54:16Z
• Commit: 3fb1b5a

[github-actions]

🚀 Latest commit deployed to https://multistore-proxy-pr-66.development-seed.workers.dev

• Date: 2026-06-04T04:54:16Z
• Commit: 3fb1b5a