test(frontend): cover authentication boundary failures

AGENTS.md

@@ -494,3 +494,11 @@ When an E2E login helper tolerates a narrowly identified navigation error,
 reassert the expected authorization URL before locating or filling credential
 fields. A matching form label is not evidence that the navigation reached its
 expected destination; retain the post-login destination check as well.
+
+For local frontend KPI reproduction, use one controlled Vitest invocation.
+Starting a second coverage or test process while the full run is active can
+exhaust local resources and create unrelated timeout failures across
+independent component tests. Those failures are execution noise, not product
+evidence. The authenticated app boundary has explicit tests for provider
+authentication errors and missing access tokens, preserving its fail-closed
+customer path while closing the corresponding `App.tsx` branches.

frontend/src/App.test.tsx

@@ -100,6 +100,13 @@ describe("App, unauthenticated", () => {
     render(<App showLabPanels />);
     expect(screen.getByRole("status")).toHaveTextContent("Loading authentication state...");
   });
+
+  it("shows the provider error without entering the product shell", () => {
+    mockAuth = { ...mockAuth, error: new Error("Authentication failed") };
+    render(<App />);
+    expect(screen.getByText("Authentication failed")).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: /log in/i })).toBeNull();
+  });
 });
 
 function jsonResponse(body: unknown): Response {
@@ -118,6 +125,12 @@ describe("App, authenticated", () => {
     };
   });
 
+  it("fails closed when authentication has no access token", () => {
+    mockAuth = { ...mockAuth, user: { profile: { preferred_username: "demo.analyst" } } };
+    render(<App />);
+    expect(screen.getByText("Authenticated, but no access token was returned.")).toBeInTheDocument();
+  });
+
   function stubBackend(options?: {
     admin?: boolean;
     calendarCommitments?: unknown[];
@@ -3112,6 +3125,15 @@ describe("App, authenticated", () => {
     expect(screen.getByLabelText("VOC verification: Northridge Grid").tagName).toBe("SPAN");
   });
 
+  it("keeps malformed verification evidence non-clickable", async () => {
+    stubBackend({ verificationEvidenceUrl: "https://[malformed" });
+    render(<App showLabPanels />);
+    await userEvent.click(await screen.findByRole("button", { name: "View post: Public post" }));
+    const badge = await screen.findByLabelText("VOC verification: Northridge Grid");
+    expect(badge.tagName).toBe("SPAN");
+    expect(screen.queryByRole("link", { name: "VOC verification: Northridge Grid" })).not.toBeInTheDocument();
+  });
+
   it("lets post_admin verify pending counterparties against web search", async () => {
     const fetchMock = stubBackend({ admin: true });
     render(<App showLabPanels />);