signed-out — no session.authenticating — a login redirect or code exchange is in progress.signed-in — a session is established (an id_token was adopted from the
callback or restored/refreshed at init). It stays signed-in until
logout(); the id_token itself may age out meanwhile — getUser() /
getIdToken() / getAccessToken() return null once it has expired,
and (with offline_access) the wallet leg refreshes on demand.
OIDC session status.