P3.10: Docs — P3 check catalog, OAuth/OIDC flow narrative, matrix rows

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P3
Depends on: P1.0, P3.1 through P3.9

Goal

Wire every new P3 check ID into the user-facing docs. No phase-3 close until this issue closes.

Acceptance criteria

• docs/USAGE.md check catalog lists every new P3 check ID with description and severity.
• New "OAuth/OIDC flow integrity" section in docs/PROVIDER_LIBRARY_COVERAGE.md documenting which client libraries (passport-oauth2, openid-client, next-auth, authlib, generic) the new checks fire on.
• docs/FRAMEWORK_COVERAGE.md updated for Next.js / Express / FastAPI OAuth flow coverage.
• docs/COVERAGE_MATRIX.md rows for every new P3 check ID, naming both the OAuth/OIDC client library and the client-storage API (where applicable).
• CHANGELOG.md unreleased entry summarises P3 additions.
• Tracker issue v0.2 — Edge-case hardening tracker #62 has the P3 milestone check box ticked.

Files touched

• docs/USAGE.md
• docs/PROVIDER_LIBRARY_COVERAGE.md
• docs/FRAMEWORK_COVERAGE.md
• docs/COVERAGE_MATRIX.md
• CHANGELOG.md

Audit-then-decide rollup

• Confirm each new P3 check has a category mapping documented in its originating issue.
• The P3.1 artifact-type decision must be recorded in this issue's resolution comment and fed into the consolidated P4.8 audit.

[bjcorder]

Implemented in d564ca6.

Summary:

• Added P3 check catalog coverage for OAuth/OIDC flow integrity and client storage hygiene.
• Added coverage matrix rows for every new P3 check ID with libraries/APIs, lifecycle stages, categories, and SARIF rule mapping.
• Added OAuth/OIDC flow integrity narrative for passport-oauth2, openid-client, NextAuth/Auth.js, Authlib, and generic code.
• Updated framework coverage for Next.js, Express, and FastAPI/Authlib/generic OAuth flow coverage.
• Updated CHANGELOG.md and ticked the P3 tracker checkboxes in v0.2 — Edge-case hardening tracker #62.

Validation:

• cargo test -q -p sessionscope-testing p3_ — passed

Notes / follow-ups:

• P3.1 artifact-type audit decision: added oauth_auth_code_flow because existing session, cookie, JWT, and bearer token artifact types did not accurately represent authorization-code flow construction and callback verification evidence. This should be included in the consolidated P4.8 audit rollup.

[bjcorder]

Implemented in PR #98: #98

Implementation commits:

• d564ca6 — P3.10 document OAuth flow and storage coverage

Validation:

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• None.