9 tasks, TDD throughout. Backend: OidcProviderNameDeriver utility, AuthCapabilitiesResponse DTO, AuthCapabilitiesController. Frontend: useAuthCapabilities hook, capability-driven LoginPage rewrite, OidcCallback ?local trap removal. Plus docs and manual smoke for the original SaaS-provisioned tenant bug. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>