Fix misleading AADSTS9002326 sign-in guidance and surface silent SPA-repair failures

[gnjoseph]

Summary

Fixes #57.

The scaffolded React SPA could fail sign-in with AADSTS9002326 even when the SPA
redirect URI was already registered, and the app's own error copy asserted this was
definitively a server-side missing-redirect-URI problem ("NOT a bug in this app and NOT a
stale or not-reloaded dev server"). That misdirects users away from the most common real
cause: the running build signs in as a different app/tenant than the one edited in the
portal (Vite inlines VITE_CLIENT_ID / VITE_TENANT_ID at build time; a duplicate display
name can also select the wrong app).

Changes

Fixes

• Soften the over-confident auth-error guidance (src/auth-error-guidance.ts + its
  byte-for-byte twin samples/react-spa-functions/src/App.tsx + the project_run_local
  note): reframe as "almost always a configuration mismatch" and lead remediation with
  confirming the running build's VITE_CLIENT_ID / VITE_TENANT_ID match the app in the
  portal Overview blade (and rebuilding after .env changes), then keep the SPA-redirect
  add steps plus an az rest GET verification. AADSTS codes / origin / az rest PATCH
  tokens are preserved.
• Surface the previously-swallowed reuse-path self-repair failure (src/tools/create-app.ts
  • new src/spa-redirect-advisory.ts): capture the addSpaRedirectUris(..., { bestEffort })
    result and, when the local SPA redirect URI can't be confirmed on a reused app, append a
    non-blocking advisory naming the exact client id / object id and the manual az rest
    PATCH/GET. The tool still succeeds.
• Add an offline sign-in verification advisory to project_hydrate_config
  (src/tools/hydrate-config.ts): append a persistent "verify this .env targets the right
  app" note to the tool output (never to .env), and warn when the tenant id is blank
  (invalid MSAL authority).

Issue reporting (companion)

• .github/ISSUE_TEMPLATE/: a general Bug report form and a dedicated Sign-in / AADSTS
  error form (collects .env vs. portal identity, spa.redirectUris via az rest, and the
  exact AADSTS code), plus config.yml contact links.
• .github/skills/report-spe-mcp-issue/: an agent skill that walks a user through gathering
  those diagnostics, redacting secrets, and drafting a gh issue create.
• docs/TROUBLESHOOTING.md: new "React SPA sign-in fails with AADSTS9002326" section (the
  canonical fix the template + skill link to). README / SUPPORT / CHANGELOG updated.

Testing

• npm run ci (typecheck + build + vitest run): all 758 tests pass (7 skipped).
• npm run lint and npm run typecheck: clean.
• interpretAuthError verified byte-for-byte identical between auth-error-guidance.ts
  and App.tsx (drift-guard test enforces this).
• Issue-form YAML + skill frontmatter validated (parse + structural checks).

Notes

The original report's exact sub-cause can't be determined from the issue alone (needs the
reporter's .env VITE_* values vs. the portal Overview client/tenant id and that app's
spa.redirectUris). These changes make that mismatch self-evident in tool output and in
the app's own error guidance instead of misdirecting the user.