P3.8: Fixtures — OAuth flow + client storage scenarios

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P3
Depends on: P3.1 through P3.7

Goal

Add representative fixtures for every new P3 check across all supported OAuth libraries and client-storage APIs.

Acceptance criteria

• Fixtures under:
  • fixtures/generic-ts/oauth-flow-{pkce,state,nonce,redirect-uri}/
  • fixtures/nextjs/authjs-{pkce,state,nonce}-evidence/
  • fixtures/express/passport-oauth2-{pkce,state}/
  • fixtures/generic-python/authlib-{pkce,state,nonce}/
  • fixtures/generic-{js,ts}/client-storage-{localstorage,sessionstorage,url-fragment}/
• Positive, negative, and false-positive variants where each applies.
• Each fixture ships expected.json.
• All placeholder values only. No real credentials, tokens, or customer code.

Files touched

• Per the directory list above.

Doc-update checklist

• None for this issue. Doc updates land in P3.10.

[bjcorder]

Implemented in 1540792.

Summary:

• Added representative P3 OAuth/OIDC fixtures across generic TypeScript, Next.js/Auth.js, Express/passport-oauth2, and Python/Authlib.
• Added client-storage fixtures for localStorage, sessionStorage, and URL fragment/path token evidence.
• Each fixture includes expected.json with placeholder-only values.
• Added semantic fixture tests covering P3 positive findings, false-positive clean cases, and OAuth redaction in JSON/Markdown rendering.

Validation:

• cargo test -q -p sessionscope-testing fixture_cases_have_expected_metadata_and_sources — passed
• cargo test -q -p sessionscope-testing p3_ — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in PR #98: #98

Implementation commits:

• 1540792 — P3.8 OAuth and client storage fixtures

Validation:

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• None.