[yang94080-cloud]

Signed-in session responses do not distinguish GitHub OAuth accounts from self-declared handles. This adds identityVerified to /api/session, derived from the stored users.github_id > 0, and documents the caller invariant that makes this distinction valid. Token admission and recording eligibility remain unchanged.

Two regression tests cover self-declared sign-in and OAuth sign-in without email. Both failed on the missing field before the implementation and passed afterward. The OAuth test uses a stub whose email endpoint would return 403; recording is disabled, so that endpoint is not requested.

Validation: the two targeted tests passed, and ./scripts/test.sh exited with code 0. The gate reported skipped browser checks due to unavailable Chromium, Java, or browser/server prerequisites, and skipped cargo-audit, actionlint, ruff, and shellcheck.

This implements P1 of #306.

Refs #306

Closes #315

---

Summary by cubic

Signed-in session responses now include identityVerified, letting clients distinguish GitHub OAuth accounts from self-declared handles. The flag is derived from users.github_id > 0, relying on the existing caller invariant that only the OAuth callback stores positive IDs. Token admission and recording eligibility are unchanged.

Regression tests cover self-declared sign-in, OAuth sign-in without email, the zero GitHub ID boundary that guards against an accidental > to >= change, and identity isolation when a typed handle matches an existing OAuth account's login. This implements P1 of #306 and closes #315.

^{Written for commit 23b5704. Summary will update on new commits.}

[yang94080-cloud]

The formatting and mutation checks now pass. The remaining failure is the report is a modal dialog with one primary action, which times out clicking #force-report.

The same failure also occurs on upstream main at 152d3e6, without this PR:

• [PR CI failure](https://github.com/sysprog21/codetrial/actions/runs/39199517502/job/117910741678)
• [Upstream main CI failure](https://github.com/sysprog21/codetrial/actions/runs/39213152783/job/117930857147)

This appears to be a timing race: without an interviewer, endInterview() schedules showReport() after 300 ms, which hides the ending overlay while the test is trying to click its offline-summary button. I have left the browser code unchanged to keep this PR scoped to #315.

[jserv]

Rebase latest main branch which lands CI fixes.

[ColtenOuO]

The last two commits are follow-ups to review on the first one. Could you squash them into a single commit before merge?

[yang94080-cloud]

Squashed into a single commit, 5786643.

[yang94080-cloud]

The browser lane failed in problem cards span desktop panels and return home on narrow screens at tests/browser/lobby.test.js:6457, with 57 !== 4. This test uses a stub server rather than the Rust session handler. The Rust, portable, and mutation checks passed. Could a maintainer rerun the failed jobs once to check reproducibility?

https://github.com/sysprog21/codetrial/actions/runs/39752627547/job/119738106918

[jserv]

Could a maintainer rerun the failed jobs once to check reproducibility?

No, it needs extra fixes. Wait for my PR.

[jserv]

Rebase latest main branch to pick up the CI fixes from #434.

[ColtenOuO]

LGTM. Let's wait for CI :)

[jserv]

Thank @yang94080-cloud for contributing!