docs: scope orchestrator gap and repair login return flow

docs/product-technical-gap-baseline.md

@@ -21,6 +21,6 @@
 - **Zotero Integration**: Papers and standards referenced by TEPP must be synced via Local Zotero API (http://localhost:23119/api/) and cited using APA 7th edition in docstrings.
 - **Testing**: We need actual testing of Psychometrics (Fast-MLSIRM parameter calibration, RMSE of estimates, Fixed-Item Parameter Calibration, CAT) against synthetic/demo data.
 - **Security & Compliance**: PII masking cannot break the system. Need SOC 2 and CSAP compliance alternatives to blind PII masking. 
-- **LLM Orchestration**: Ensure ALL LLM calls route through `contextual-orchestrator` utilizing API keys (BYTEZ, NVIDIA, OPENROUTER, OPENAI) with auto model discovery and optimal reasoning effort allocation (Fugu/Conductor/TRINITY research).
+- **LLM Orchestration**: Partially resolved -- every one of `backend/app/main.py`'s 13 orchestrator client factories (`_keyman_extraction_client`, `_entity_relationship_client`, `_organization_name_resolution_client`, `_customer_hint_resolution_client`, `_corporate_hierarchy_inference_client`, `_post_summary_client`, `_adjudication_client`, `_post_structure_client`, `_post_chat_client`, `_commitment_extraction_client`, `_vision_client`, `_embedding_client`, `_post_evaluation_client`) routes through `settings.orchestrator_base_url`/`orchestrator_api_key` -- confirmed no hardcoded provider SDK, key, or endpoint (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `BYTEZ_API_KEY`, `NVIDIA_NIM_API_KEY`, `OPENROUTER_API_KEY`) appears anywhere in `lineageweave/`, `backend/`, or `scripts/`. Generative and VISION requests send `"mode": "auto"` plus a `reasoning_effort` value, delegating model selection and reasoning-depth allocation per call; the embedding client uses the orchestrator's dedicated embedding contract and correctly has no reasoning-depth field. Still open: exact-head upstream evidence that `contextual-orchestrator` discovers all configured provider credentials and applies its Fugu/Conductor/TRINITY policy. That evidence must be fixed in the upstream repository when absent; LineageWeave client routing alone does not prove it.
 
 *This document is continuously updated by the hourly automated agent loop.*

frontend/src/App.test.tsx

@@ -41,6 +41,9 @@ describe("App, unauthenticated", () => {
         state: expect.objectContaining({ returnUrl: expect.stringMatching(/^\//) }),
       }),
     );
+    // Persisted as a fallback in case the OIDC state round-trip is dropped
+    // (see oidcReturnUrl.ts's restoreOidcReturnUrl, consumed in main.tsx).
+    expect(window.sessionStorage.getItem("lineageweave.oidc.returnUrl")).toMatch(/^\//);
   });
 });
 

frontend/src/App.tsx

@@ -4610,7 +4610,8 @@ export default function App({ showLabPanels = false }: { showLabPanels?: boolean
             </div>
             <div className="login-controls">
               <button className="btn-primary" onClick={() => {
-                const returnUrl = window.location.pathname + window.location.search;
+                const returnUrl = returnUrlFromLocation();
+                rememberOidcReturnUrl(returnUrl);
                 void auth.signinRedirect({ state: { returnUrl } });
               }}>
                 {t("Log in")}
@@ -4620,7 +4621,6 @@ export default function App({ showLabPanels = false }: { showLabPanels?: boolean
               <small>Enterprise SSO Authentication</small>
             </div>
           </div>
-          {destination === "admin" ? <AdminPanel currentBrandName={brandName} onBrandNameChange={setBrandName} accessToken={accessToken} /> : null}
       </main>
         <footer className="app-footer" role="contentinfo">
           <div className="app-footer-title">