chore(oidc): consolidate test OIDCConfig helper + fix exceptions banner (cumulative q-4, q-5)

q-4: tests/test_oidc.py's _make_config and tests/test_oidc_handlers.py's
_make_oidc_config built the same OIDCConfig with sensible defaults but
had drifted — only the handlers helper set redirect_base. After b3
made redirect_base operationally required, every test_oidc.py test
that exercised redirect_base had to override it explicitly. A future
test could omit redirect_base and silently exercise the wrong
production path.

Moves make_oidc_test_config to tests/conftest.py with the more
complete handler-version defaults (including redirect_base). Both
test files import it under their existing local alias
(_make_config / _make_oidc_config) so the 60+ call sites in
test_oidc.py and the handler tests don't have to change.

q-5: section banner '# Exception' (singular) at oidc.py:79 became
inconsistent after b5 (callback robustness) added OIDCKeyNotFoundError.
Renamed to '# Exceptions'.

tests/conftest.py

@@ -1,10 +1,42 @@
 from __future__ import annotations
 
 import os
+from typing import TYPE_CHECKING, Any
 from unittest.mock import MagicMock
 
 import pytest
 
+if TYPE_CHECKING:
+    from turnstone.core.oidc import OIDCConfig
+
+
+def make_oidc_test_config(**overrides: Any) -> OIDCConfig:
+    """Build a test ``OIDCConfig`` with sensible defaults.
+
+    Shared between ``test_oidc.py`` and ``test_oidc_handlers.py`` so the
+    defaults (including the now-required ``redirect_base``) stay aligned.
+    """
+    from turnstone.core.oidc import OIDCConfig
+
+    defaults: dict[str, Any] = {
+        "enabled": True,
+        "issuer": "https://idp.example.com",
+        "client_id": "my-client",
+        "client_secret": "my-secret",
+        "scopes": "openid email profile",
+        "provider_name": "TestIDP",
+        "role_claim": "",
+        "role_map": {},
+        "password_enabled": True,
+        "redirect_base": "https://app.example.com",
+        "authorization_endpoint": "https://idp.example.com/authorize",
+        "token_endpoint": "https://idp.example.com/token",
+        "userinfo_endpoint": "https://idp.example.com/userinfo",
+        "jwks_uri": "https://idp.example.com/.well-known/jwks.json",
+    }
+    defaults.update(overrides)
+    return OIDCConfig(**defaults)
+
 
 def pytest_addoption(parser: pytest.Parser) -> None:
     parser.addoption(

tests/test_oidc.py

@@ -15,8 +15,8 @@ import httpx
 import jwt as pyjwt
 import pytest
 
+from tests.conftest import make_oidc_test_config as _make_config
 from turnstone.core.oidc import (
-    OIDCConfig,
     OIDCError,
     OIDCKeyNotFoundError,
     _ensure_default_role,
@@ -39,27 +39,6 @@ from turnstone.core.oidc import (
 # ---------------------------------------------------------------------------
 
 
-def _make_config(**overrides) -> OIDCConfig:
-    """Build a test OIDCConfig with sensible defaults."""
-    defaults = {
-        "enabled": True,
-        "issuer": "https://idp.example.com",
-        "client_id": "my-client",
-        "client_secret": "my-secret",
-        "scopes": "openid email profile",
-        "provider_name": "TestIDP",
-        "role_claim": "",
-        "role_map": {},
-        "password_enabled": True,
-        "authorization_endpoint": "https://idp.example.com/authorize",
-        "token_endpoint": "https://idp.example.com/token",
-        "userinfo_endpoint": "https://idp.example.com/userinfo",
-        "jwks_uri": "https://idp.example.com/.well-known/jwks.json",
-    }
-    defaults.update(overrides)
-    return OIDCConfig(**defaults)
-
-
 def _mock_storage(**overrides):
     """Build a MagicMock with sensible storage defaults."""
     s = MagicMock()

tests/test_oidc_handlers.py

@@ -18,10 +18,7 @@ from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.routing import Mount, Route
 from starlette.testclient import TestClient
 
-if TYPE_CHECKING:
-    from starlette.requests import Request
-    from starlette.responses import Response
-
+from tests.conftest import make_oidc_test_config as _make_oidc_config
 from turnstone.console.server import (
     admin_delete_oidc_identity,
     admin_list_oidc_identities,
@@ -35,32 +32,9 @@ from turnstone.core.auth import (
 from turnstone.core.oidc import OIDCConfig, OIDCError, OIDCKeyNotFoundError
 from turnstone.core.storage._sqlite import SQLiteBackend
 
-# ---------------------------------------------------------------------------
-# Helpers
-# ---------------------------------------------------------------------------
-
-
-def _make_oidc_config(**overrides: Any) -> OIDCConfig:
-    """Build a test OIDCConfig with sensible defaults."""
-    defaults: dict[str, Any] = {
-        "enabled": True,
-        "issuer": "https://idp.example.com",
-        "client_id": "my-client",
-        "client_secret": "my-secret",
-        "scopes": "openid email profile",
-        "provider_name": "TestIDP",
-        "role_claim": "",
-        "role_map": {},
-        "password_enabled": True,
-        "redirect_base": "https://app.example.com",
-        "authorization_endpoint": "https://idp.example.com/authorize",
-        "token_endpoint": "https://idp.example.com/token",
-        "userinfo_endpoint": "https://idp.example.com/userinfo",
-        "jwks_uri": "https://idp.example.com/.well-known/jwks.json",
-    }
-    defaults.update(overrides)
-    return OIDCConfig(**defaults)
-
+if TYPE_CHECKING:
+    from starlette.requests import Request
+    from starlette.responses import Response
 
 # ---------------------------------------------------------------------------
 # Thin handler wrappers — match the pattern used in server.py / console

turnstone/core/oidc.py

@@ -76,7 +76,7 @@ _KNOWN_TRUSTED_ENDPOINT_HOSTS: dict[str, frozenset[str]] = {
 
 
 # ---------------------------------------------------------------------------
-# Exception
+# Exceptions
 # ---------------------------------------------------------------------------