Say which accounts belong to the provider, and to whom

"Has an identity at the provider" and "has no password here" are two
different questions, and the interface was answering the second while being
asked the first: an account that existed before and was linked — the usual
case for whoever sets this up — carried no mark at all in the administration
list.

The server now reports both. The list marks every linked account, says which
of them have no password, and offers to give one rather than to reset
something that is not there. The account panel names the provider it signs in
through, which is also the missing explanation for the password tab that
disappeared.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

e2e/oidc.mjs

@@ -99,6 +99,54 @@ try {
   check(!!created, "an account was made for them", newcomer);
   check(created?.isAdmin === false, "and it is not an administrator");
   check(created?.signsInWithProvider === true, "and has no password of its own");
+  check(created?.linkedToProvider === true, "and is marked as belonging to the provider");
+
+  /* ── what the two people involved see ──
+   * The one signing in: no password tab, because there is no password behind
+   * it. The administrator: which accounts these are, without asking anybody. */
+  await page.getByTitle("Account").click();
+  await page.waitForTimeout(900);
+  const tabs = await page.locator("button").allInnerTexts();
+  check(
+    !(await page.getByRole("button", { name: "Password", exact: true }).count()),
+    "the account panel offers no password to change",
+    tabs.join(" | ").slice(0, 120)
+  );
+  check(
+    (await page.locator("[data-account-sso]").count()) === 1,
+    "and says which provider it signs in through instead"
+  );
+  check(
+    (await page.locator("[data-account-sso]").innerText()).includes("Test IdP"),
+    "by name",
+    await page.locator("[data-account-sso]").innerText()
+  );
+  await page.keyboard.press("Escape");
+  await page.waitForTimeout(500);
+
+  await adminPage.getByTitle("Account").click();
+  await adminPage.waitForTimeout(700);
+  await adminPage.getByRole("button", { name: "Administration" }).click();
+  await adminPage.waitForTimeout(1500);
+  const ssoRow = adminPage.locator(`text=${newcomer}`).locator("xpath=ancestor::div[1]");
+  check(
+    (await adminPage.locator("[data-user-sso]").count()) >= 1,
+    "the administrator sees which accounts come from the provider",
+    `${await adminPage.locator("[data-user-sso]").count()} marked`
+  );
+  check(
+    (await ssoRow.innerText()).includes("SSO"),
+    "on the row of the account itself",
+    (await ssoRow.innerText()).replace(/\n/g, " ").slice(0, 100)
+  );
+  check(
+    (await adminPage.locator("body").innerText()).includes("Give a password"),
+    "and is offered to give it a password rather than to reset one"
+  );
+  await adminPage.keyboard.press("Escape");
+  await adminPage.waitForTimeout(400);
+  await adminPage.keyboard.press("Escape");
+  await adminPage.waitForTimeout(600);
 
   /* The address is cleaned, and what was in it was a ticket, not the token. */
   const returned = seen.find((u) => u.includes("oidc="));
@@ -163,6 +211,10 @@ try {
     linked[0]?.signsInWithProvider === false,
     "and it keeps the password it already had — one way in does not close the other"
   );
+  check(
+    linked[0]?.linkedToProvider === true,
+    "while still being shown as one that can use the provider"
+  );
   await second.context().close();
 
   /* ── the ways it must fail ── */