Fix OpenBao login falling back to token auth

Add synchronous redirect-bootstrap, direct KeyCape OIDC on sign-in, and mount
watching so the UI no longer lands on ?with=token when netkingdom is hidden
from unauthenticated mount listing. Document listing_visibility tune helper.

scripts/openbao-verify-login-overlay.sh

@@ -58,6 +58,11 @@ overlay_js="$(curl -fsS "$BASE_URL/ui/platform-overlay/overlay.js")"
 overlay_css="$(curl -fsS "$BASE_URL/ui/platform-overlay/overlay.css")"
 presets_json="$(curl -fsS "$BASE_URL/ui/platform-overlay/presets.json")"
 
+require_pattern \
+  "index.html injects redirect bootstrap" \
+  "$index_html" \
+  '/ui/platform-overlay/redirect-bootstrap\.js'
+
 require_pattern \
   "index.html injects overlay.js" \
   "$index_html" \
@@ -73,6 +78,11 @@ require_pattern \
   "$overlay_js" \
   'keycape-overlay-active'
 
+require_pattern \
+  "overlay.js starts direct KeyCape OIDC redirect" \
+  "$overlay_js" \
+  'oidc/auth_url'
+
 require_pattern \
   "presets.json targets netkingdom mount" \
   "$presets_json" \