Fix auth bypass on provider misconfiguration

Fixed a security vulnerability where invalid provider configurations (missing issuer/authorization endpoints) caused auth checks to fail open, exposing protected routes. The fix adds a helper that treats non-OK responses as "no session" so all auth entry points properly reject requests during misconfiguration, with a new regression test covering the InvalidEndpoints scenario.