Allow tenant invites to redirect to Lobby

[woksin]

Summary

• Model matching-tenant invitation completion with the explicit InvitationCompletionDestination enum (ReturnUrl / Lobby).
• Add Invite.MatchingTenantInvitationDestination and the Aspire WithMatchingTenantInvitationDestination(...) helper.
• Keep ReturnUrl as the compatibility default, preserving the released matching-tenant behavior.
• Compare the validated invitation tenant claim with the resolved request tenant; equality is routing evidence, not issuer identity.

Cratis Studio is unchanged: the invitation staging and exchange APIs and payloads are not modified.

Security boundary

This is a redirect-only setting. It changes only the destination after successful completion; invitation validation, staging, exchange, recipient binding, attestations, transaction consumption, cookies, and sessions remain unchanged. Matching tenant values do not prove which tenant issued the invitation.

Verification

• AuthProxy specs: 2036 passed.
• Aspire specs: 74 passed.
• Focused current/callback/replay matrix:

Flow	ReturnUrl	Lobby
Current/post-login completion	Continues toward the challenge return URL	Selects the configured Lobby frontend
Provider callback completion	Preserves the challenge return URL	Redirects to Lobby after the same successful exchange
Stale-cookie replay	Does not exchange again or redirect to Lobby; clears the cookie	Does not exchange again; redirects to Lobby with the invitation ID and clears the cookie

• Mutation check: 2/2 mutations killed.
• Documentation limitation: the shared Documentation/web full check is unavailable because isolated runs timed out on unrelated Chronicle client generation; the source documentation stale-terminology scan and diff check passed.

Release note

Added

• Configure matching-tenant invitations to complete at the challenge ReturnUrl or continue to Lobby. (Successful OAuth completion should redirect to configured Lobby URL even when invite tenant matches resolved tenant #109)

Security

• Resolve nanoid to ^3.3.18, fixing GHSA-2v37-7h3g-55p8 (HIGH).
• Pin security workflow actions to verified full SHAs with persist-credentials: false.
• Add a frontend dependency audit job blocking HIGH/CRITICAL advisories.

Verification audit

• Code review: APPROVE
• Security review: APPROVE
• Evidence SHA-256: c3d8b25ea41a9362c942bdc7491ac6692dca21b7dba0219bab2e641eb678c4c2