0.0.1 — one-button SSO end-to-end against solid.social #1

Bootstrap issue tracking the v0.1 milestone.

Goal

A working "click the button, magic happens, you're at your pod" UX, end-to-end:

1. User lands at https://jss.live/sso/ (or any other host of this repo's static files)
2. Clicks Sign in
3. Browser redirects to https://solid.social/idp/auth?... (the configured IdP)
4. User completes whichever identity proof they prefer (Schnorr via Podkey/xlogin, passkey, password) — this part is the JSS server's job, not ours
5. IdP redirects back to https://jss.live/sso/ with the auth code
6. SSO page hydrates the Solid-OIDC session and reads the WebID
7. Redirects the browser to the WebID's pod root

For same-pod users (the user's WebID is hosted on the same server as the IdP), the resolution is local and zero-typing. Cross-pod is the next milestone (v0.3, depends on JSS#414).

Acceptance

• Page loads and renders the button on https://jss.live/sso/
• Button click triggers a redirect to https://solid.social/idp/auth?...
• Signing in via Schnorr (Podkey/xlogin extension) lands back on the SSO page with isLoggedIn = true
• After hydration, the page redirects to the user's pod root within ~800ms
• ?next=<url> URL param sends the user to that destination instead of the pod root
• ?idp=<oidc-issuer> URL param uses a different IdP
• Dark-mode CSS variables render correctly

Out of scope (deferred)

• v0.2 — Auto-discover IdP from a Nostr extension's pubkey (NIP-05 / did:nostr DID-doc) so the SSO page can pick the right IdP without the ?idp= param.
• v0.3 — Direct Nostr-relay resolution. Removes the configured-IdP dependency entirely for cross-pod identities.
• v0.4 — Passkey-only fallback. Sign in without a Nostr extension.

Refs

• JSS#408 — well-known did:nostr endpoint
• JSS#411 — subdomain index
• JSS#414 — relay-based resolver (v0.3 prerequisite)
• JSS#370 — JSS Git (the no-build precedent we're modeling after)