fix(auth): show retryable signup failures

[neubig]

Summary

• redirect browser-based Keycloak connection failures back to the login page instead of exposing raw 500/503 responses
• propagate exhausted Keycloak retries during duplicate-email signup checks and handle late provider-token setup failures
• show persistent, localized guidance telling users their account is safe and they can restart sign-in
• preserve safe relative post-login destinations when redirecting after an outage

Validation

• PYTHONPATH=. poetry run pytest tests/unit/test_auth_routes.py -q (57 passed)
• npm run test -- --run __tests__/routes/login.test.tsx (23 passed)
• npm run typecheck:staged
• npm run check-translation-completeness
• npm run build
• pre-commit run --config ./dev_config/python/.pre-commit-config.yaml

Notes

• The repository pre-commit hook’s frontend ESLint step currently resolves incompatible parent-worktree packages and fails inside @typescript-eslint/no-unused-expressions; the changed frontend files passed TypeScript, Prettier, focused tests, translation completeness, and the production build.

This pull request was created by an AI agent (OpenHands) on behalf of the user.

---

Enterprise server image for this PR:

ghcr.io/openhands/enterprise-server:sha-0be53cf

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
enterprise/server/auth/user
default_user_authorizer.py					80-86
enterprise/server/routes
auth.py					92-99, 319-348, 501-510
Project Total

This report was generated by python-coverage-comment-action