Motivation

Upgrade Modgud from SignalARRR 4.3.2 to 5.0.0-beta.3. The v4 client could lose the authorization payload for streams created after the authentication cache aged out, producing Authorization not provided while navigating between Admin SPA views. The migration also hardens frontend stream restoration so reconnects do not create duplicate subscriptions.

Surface touched

• Authentication slice (Modgud.Authentication/)
• Authorization slice (Modgud.Authorization/)
• OAuth/OIDC server (OpenIddict, /connect/*, OAuth aggregates)
• Admin API (Modgud.Api/Features/Admin/)
• Admin SPA (src/frontend-vue/)
• Plattform area (branding, assets, observability, inbox, settings)
• Recovery CLI (Modgud.Authentication/Cli/)
• Realm provisioning / multi-tenancy
• Docs (docs/)
• Build / CI / Docker
• Other: SignalARRR server integration and package migration

Tests

• Unit tests added / updated for the changed code
• Integration tests added / updated where applicable
• dotnet test is green locally
• Frontend changes verified in the browser (login and repeated Admin SPA navigation)

Local verification:

• Backend build green
• Frontend type-check and production build green
• Frozen pnpm lockfile install green
• 1,542 Modgud unit tests green
• 78 SignalARRR v5 authentication regression tests green across net8/net9/net10
• 40 authenticated SPA view switches without Authorization not provided or duplicate subscriptions
• Forced local backend outage recovered automatically; active streams reloaded once and another 12 view switches remained clean
• Fresh Magic-Link session stayed authenticated beyond the five-minute SecurityStamp validation point

Docs

• docs/ updated where user-visible behavior changed
• docs/roadmap.md updated if a roadmap item moved
• N/A — internal dependency migration and connection lifecycle fix

Breaking changes

• No breaking changes
• Breaking change(s) described below:

Notes

The backend endpoint registration follows the v5 API (MapSignalARRRHub). Frontend reconnect callbacks now run only after reconnect; initial stream creation is explicit. Active stream subscriptions survive automatic reconnect and a manual restart after reconnect exhaustion without being duplicated.