iOS Safari doesn't reliably follow HTTP 302 redirects after HTML form POST submissions. The OIDC login flow now uses fetch() + JS redirect via window.location.href, which works on all platforms. Also includes the /auth/callback → /oauth/callback forwarding fix for OIDC clients that was deployed earlier.