fix: block clientId login in OIDC mode (crash fix)

- ui/routes/auth.js: auth.isOidc → redirect to /login with error instead of
  calling issueMockToken which throws 'Mock keypair not initialized'
- This was crashing the process via unhandled promise rejection

ui/routes/auth.js

@@ -137,6 +137,11 @@ function createRouter({ auth, MOCK_USERS, authLimiter }) {
     // ── Вход по clientId (отладка, mock) ───────────────────────────────────
     if (!clientId || !clientId.trim()) return res.redirect('/login?error=Введите+clientId');
 
+    // В OIDC-режиме mock-токен бессмысленен — редиректим на KC
+    if (auth.isOidc) {
+      return res.redirect('/login?error=Вход+по+clientId+недоступен+в+SSO-режиме.+Войдите+через+Keycloak.');
+    }
+
     const trimmed = clientId.trim();
     const allClientIds = trimmed.split(',').map(s => s.trim()).filter(Boolean);
     const activeClientId = allClientIds[0];