Select & integrate OIDC client library

Status: ✅ Done — with a library pivot.

Adopted a battle-tested, client-side, headless OIDC library and integrated it as plain TypeScript, deliberately avoiding the Nuxt auth modules (nuxt-oidc-auth, nuxt-auth-utils, @sidebase/nuxt-auth) because those are server-side/BFF and incompatible with Red's cacheable-anonymous-origin architecture.

oidc-spa was tried first and then rejected. Because the identity provider (account.ietf.org) is cross-origin to the site (rfc-editor.org), third-party cookies are blocked, and oidc-spa falls back to a full-page redirect through the IdP on every page load to restore the session — with no configuration to turn it off. That produces a visible redirect flash on every load (deep links, refresh, new tabs), which is unacceptable for a high-traffic site. It is a fundamental mismatch; oidc-spa's own documentation steers SSR/multi-page apps away.

oidc-client-ts was chosen. It is client-only, framework-agnostic, and headless. The session persists in localStorage and renews via the refresh token against the token endpoint (CORS), so page loads never redirect — only an explicit login does. It is wrapped in plain TypeScript at app/utilities/oidc.ts, dynamically imported so nothing executes during SSR and it stays out of the main bundle.

Start by reading the existing integration at app/utilities/oidc.ts and review how the selected client-only OIDC library is dynamically imported. Done means the integration avoids SSR execution and main-bundle inclusion, persists sessions in localStorage, renews through the token endpoint, and redirects only for explicit login.