Start the WorkOS AuthKit login flow.

Sets a short-lived CSRF state cookie and redirects (302) to WorkOS AuthKit. On success WorkOS redirects back to /auth/callback. Browser-only — not for programmatic clients.

Mode-conditional: when no dvt-owned session flow is configured — snowflake mode, where SPCS ingress authenticates every request off an identity header, and local dev with auth disabled — no WorkOS handler is mounted and this path answers 303 to the SPA root instead, so a bookmark or stale tab lands back in the app rather than on a JSON 404 (DVT-3463). No session is created either way. /auth/callback is deliberately NOT mounted in that branch: there is no flow to complete, and a silent redirect there would mask a genuine redirect-URI misconfiguration.