Correct OIDC mode handling in restricted app.

frontend/auth/restricted/RestrictedApi.vue

@@ -36,7 +36,18 @@ function extractRemoteToken() {
 
 // Parse URL hash fragment
 const hashParams = new URLSearchParams(window.location.hash.slice(1))
-const authMode = ['reauth', 'forbidden'].includes(hashParams.get('mode')) ? hashParams.get('mode') : 'login'
+
+// Determine auth mode based on URL path
+// - /auth/restricted/oidc: OIDC flow, no session dependency
+// - /auth/restricted/iframe: iframe embedding, mode from hash params
+// - Other paths: forward auth, mode from hash params
+let authMode
+if (window.location.pathname === '/auth/restricted/oidc') {
+  authMode = 'oidc'
+} else {
+  // Both iframe and forward auth use hash params for mode (forbidden/login/reauth)
+  authMode = ['reauth', 'forbidden'].includes(hashParams.get('mode')) ? hashParams.get('mode') : 'login'
+}
 
 function postToParent(message) {
   if (window.parent && window.parent !== window) {

frontend/src/components/RestrictedAuth.vue

@@ -66,7 +66,7 @@ const props = defineProps({
   mode: {
     type: String,
     default: 'login',
-    validator: (value) => ['login', 'reauth', 'forbidden'].includes(value)
+    validator: (value) => ['login', 'reauth', 'forbidden', 'oidc'].includes(value)
   },
   oidcQueryString: {
     type: String,
@@ -275,7 +275,12 @@ watch(initializing, (newVal) => {
 
 onMounted(async () => {
   await fetchSettings()
+  // OIDC mode doesn't depend on session state - skip validation
+  if (props.mode !== 'oidc') {
     await validateSession()
+  } else {
+    currentView.value = 'login'
+  }
   initializing.value = false
 
   // Add click handler for inline links