Tests: auth/oauth.py has only 20% coverage — OAuth login, callback, and logout flows are untested

[BHUVANSH855]

Test Coverage Gap

Summary

app/auth/oauth.py has only 20% test coverage (96 of 120 statements untested).
The entire OAuth flow — GitHub login redirect, callback token exchange, user
upsert, session creation, and logout — has no tests at all.

Uncovered Lines

Lines 36–117 (dev bypass login), 127–238 (real OAuth callback), 247–255 (logout)

Why This Matters

This is the authentication entry point for the entire dashboard. Bugs here
could allow:

• Session fixation attacks
• OAuth state parameter bypass
• User account confusion (wrong user upserted on callback)
• Token not being encrypted before storage

The dev-mode bypass (lines 36–117) is also untested, meaning the
demo_maintainer auto-login path that runs in all non-production environments
has never been validated by tests.

What Needs Tests

• GET /auth/login — dev bypass creates demo_maintainer session correctly
• GET /auth/login — production path redirects to GitHub with correct state cookie
• GET /auth/callback — valid code exchanges for token, user upserted, session created
• GET /auth/callback — invalid/missing state returns 400
• GET /auth/callback — missing code returns 400
• GET /auth/logout — session deleted from DB, cookie cleared