fix(auth): callback route redirect order + favicon.ico

- Move callback route exception check BEFORE auth redirect check
- This was preventing OIDC token exchange from ever happening
- Add favicon.ico to web root for browser tab icon

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.10] - 2026-01-04
+
+### Fixed
+- Fixed OIDC callback route being redirected to login before processing
+  - Moved callback route exception check BEFORE the auth redirect check in router
+  - This was preventing token exchange from ever happening
+- Added favicon.ico to web root for proper browser tab icon display
+
+## [1.0.9] - 2026-01-04
+
+### Fixed
+- Fixed OIDC callback Riverpod state modification error
+  - Deferred callback processing to `addPostFrameCallback` to avoid modifying state during widget build
+
 ## [1.0.8] - 2026-01-04
 
 ### Changed

lib/routing/app_router.dart

@@ -34,6 +34,11 @@ GoRouter appRouter(Ref ref) {
         return null;
       }
 
+      // Allow callback route through without auth check (must be checked FIRST!)
+      if (state.matchedLocation == AppRoutes.callback) {
+        return null;
+      }
+
       final isAuthenticated = authState.value?.isAuthenticated ?? false;
       final isLoginRoute = state.matchedLocation == AppRoutes.login;
 
@@ -47,11 +52,6 @@ GoRouter appRouter(Ref ref) {
         return AppRoutes.frontHall;
       }
 
-      // Allow callback route through without auth check
-      if (state.matchedLocation == AppRoutes.callback) {
-        return null;
-      }
-
       return null;
     },
     routes: [
@@ -286,7 +286,10 @@ class _OidcCallbackPageState extends ConsumerState<_OidcCallbackPage> {
   @override
   void initState() {
     super.initState();
-    _processCallback();
+    // Defer callback processing to avoid Riverpod state modification during build
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      _processCallback();
+    });
   }
 
   Future<void> _processCallback() async {

pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.0.8+1
+version: 1.0.10+1
 
 environment:
   sdk: ^3.10.4

web/index.html

@@ -27,6 +27,7 @@
   <link rel="apple-touch-icon" href="icons/Icon-192.png">
 
   <!-- Favicon -->
+  <link rel="icon" type="image/x-icon" href="favicon.ico"/>
   <link rel="icon" type="image/png" href="favicon.png"/>
 
   <title>Tatlock</title>