Spec 12 S3: job oidcCheck refreshes every OpenID session at the provider every 15 minutes and applies groups and role again; invalid_grant ends the session, an outage doesn't. A live test makes a throwaway Keycloak realm and signs in through its login form (passed against 26.8.1). NODE_EXTRA_CA_CERTS for a private CA. Admin guide: docs/admin-guide/sign-in.md.