Fix SSO black page - clear bad tokens and exclude /auth from cache

- Add clearBadTokens() to remove tokens with wrong issuer
- Exclude /auth routes from service worker caching
- Prevents black page when tokens from old auth config are stored

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

public/service-worker.js

@@ -1,5 +1,5 @@
 // public/service-worker.js
-const CACHE_NAME = 'sociowire-v5';
+const CACHE_NAME = 'sociowire-v6';
 const PRECACHE = [
   '/icons/icon-192x192.png',
   '/icons/icon-512x512.png',
@@ -27,8 +27,8 @@ self.addEventListener('activate', event => {
 self.addEventListener('fetch', event => {
   const url = new URL(event.request.url);
 
-  // Never cache API calls - always fetch fresh data
-  const isAPI = url.pathname.startsWith('/api/') || url.pathname.startsWith('/ws');
+  // Never cache API calls or auth endpoints - always fetch fresh data
+  const isAPI = url.pathname.startsWith('/api/') || url.pathname.startsWith('/ws') || url.pathname.startsWith('/auth');
   if (isAPI) {
     event.respondWith(fetch(event.request));
     return;

src/auth/AuthContext.jsx

@@ -2,6 +2,7 @@ import React, { createContext, useContext, useEffect, useMemo, useRef, useState
 import Keycloak from "keycloak-js";
 import {
   clearAuth,
+  clearBadTokens,
   guessUsernameFromToken,
   jwtExpSeconds,
   loadAuth,
@@ -360,6 +361,10 @@ export function AuthProvider({ children }) {
     setStatus("loading");
     setError("");
     setLastInfo("");
+
+    // Clear tokens from old/wrong issuer (e.g., auth.sociowire.com vs us2.sociowire.com)
+    clearBadTokens("us2.sociowire.com");
+
     const saved = loadAuth();
     if (!saved?.access_token) {
       try {

src/auth/authStorage.js

@@ -55,3 +55,22 @@ export function guessUsernameFromToken(token) {
     ""
   );
 }
+
+// Clear tokens if they have wrong issuer (e.g., from old auth config)
+export function clearBadTokens(expectedIssuerSubstring) {
+  try {
+    const saved = loadAuth();
+    if (!saved?.access_token) return false;
+    const p = decodeJwtPayload(saved.access_token);
+    if (!p?.iss) return false;
+    // If issuer doesn't contain expected substring, clear it
+    if (!p.iss.includes(expectedIssuerSubstring)) {
+      console.warn("[Auth] Clearing tokens with wrong issuer:", p.iss);
+      clearAuth();
+      return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}