LG-13477: Fix reprompt for adding PIV on sign-in after reauthentication

[aduth]

🎫 Ticket

LG-13477

🛠 Summary of changes

Fixes an issue where a user would be returned to the PIV prompt screen when prompted to add a PIV card to their account after signing in when having previously failed logging in with PIV due to the card not being associated with a user.

Part of the changes here improve spec helpers relating to PIV/CAC, which currently do not reflect real-world usage, since the PIV/CAC-after-sign-in prompt does not return a user to 'login/add_piv_cac/success' in live code. Instead, the prompt page submits to the '/present_piv_cac' route (Users::PivCacAuthenticationSetupController#submit_new_piv_cac), and is therefore redirected back to '/piv_cac' after being returned from the PKI service. The stub abstractions wrongly assumes that the PKI service will always redirect back to the URL that the user submitted the form at.

📜 Testing Plan

1. Go to http://localhost:3000
2. Sign into your account, make sure to complete MFA and click “Remember this browser”
3. Sign out
4. Wait for reauthentication window to lapse (20 minutes)
   • Optionally, reconfigure reauthn_window to a short number in config/application.yml to streamline testing
5. Click “Sign in with your government employee ID”
6. Click “Insert your PIV/CAC”
7. Authenticate with your PIV
8. See error message “Your PIV/CAC is not connected to an account”
9. Click “Sign in” (or “Go back to sign in”)
10. Proceed to sign in to your account using email and password
11. Finish signing in. You should see “Reauthentication required” after signing in. Finish reauthentication
12. See screen “Add your PIV or CAC”
13. Enter a nickname in the “PIV/CAC nickname” field
14. Click “Add PIV/CAC card”

Before: The page appears to reload, with a success banner "A PIV/CAC card was added to your account"
After: You're brought to the account page, with a success banner "A PIV/CAC card was added to your account"

👀 Screenshots

Before	After

[aduth]

For posterity, surfacing an explainer of the fix from the extended commit description of 003eb4e:

Because we were considering the PIV session value first, we weren't clearing stored_location from the session, and therefore the user would be confusingly redirected back to PIV setup screen after they'd already seen it