Honor Tools guest hints during silent handoffs (#293)

ddiff --git a/apps/gateway/server/auth/routes.js b/apps/gateway/server/auth/routes.js
iindex a2d4119..3cd06db 100644
---- a/apps/gateway/server/auth/routes.js
++++ b/apps/gateway/server/auth/routes.js
@@@ -317,6 +317,9 @@ function createAuthRoutes(config, auth) {
              if (existing && await auth.verify(existing)) {
                  return res.redirect(next);
              }
++            // A cross-site handoff link can reach this route without running the destination navbar first.
++            // Its explicit sign-out still wins; an interactive login (without silent=1) remains available.
++            if (req.cookies?.[SSO_HINT_COOKIE] === 'guest') return res.redirect(next);
          }
          // The SDK's authorize URL: state + PKCE (S256). The verifier goes into a flow cookie
          // of its own and comes back with the code.
ddiff --git a/apps/gateway/test/auth-sso.test.js b/apps/gateway/test/auth-sso.test.js
iindex 4c18a37..143242f 100644
---- a/apps/gateway/test/auth-sso.test.js
++++ b/apps/gateway/test/auth-sso.test.js
@@@ -139,6 +139,15 @@ function gateway(net, { clientSecret = CLIENT_SECRET } = {}) {
          const { app, auth } = gateway(net);
          gw = await serve(app);
  
++        const guest = await fetch(`${gw.base}/auth/login?silent=1&next=${encodeURIComponent('https://maps.openvibe.tools/')}`, {
++            redirect: 'manual', headers: { Cookie: 'ov_sso_hint=guest' },
++        });
++        assert.strictEqual(guest.status, 302);
++        assert.strictEqual(guest.headers.get('location'), 'https://maps.openvibe.tools/', 'guest handoff never visits Network');
++        assert.strictEqual(guest.headers.get('set-cookie'), null, 'no flow or session is created for a guest');
++        const explicit = await fetch(`${gw.base}/auth/login`, { redirect: 'manual', headers: { Cookie: 'ov_sso_hint=guest' } });
++        assert.strictEqual(new URL(explicit.headers.get('location')).pathname, '/oauth/authorize', 'an explicit login still works');
++
          // ── GET /auth/login: the authorize URL with a PKCE S256 challenge ──
          const login = await fetch(`${gw.base}/auth/login?next=%2Ftools%3Fa%3D1`, { redirect: 'manual' });
          assert.strictEqual(login.status, 302, 'the login redirects');
ddiff --git a/test/gateway-sso.test.js b/test/gateway-sso.test.js
nnew file mode 100644
iindex 0000000..1fd6353
---- /dev/null
++++ b/test/gateway-sso.test.js
@@@ -0,0 +1,3 @@
++'use strict';
++// Expose the gateway's HTTP sign-in flow tests to ov test's root-level discovery.
++require('../apps/gateway/test/auth-sso.test.js');