docs(todo): note untested auth session claim mapping (#3)

Captured during /spec-review of spec 001: the OIDC roles-claim mapping
in auth.ts is unchanged by this fix and has no test yet.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hendrikebbers

docs/TODO.md

@@ -0,0 +1,15 @@
+# TODO
+
+## Test the OIDC session claim mapping in `auth.ts`
+
+Add tests for the NextAuth `session` callback in `src/server/auth.ts`: the
+`roles` claim should be carried through to `session.roles` 1:1, and a missing
+claim should yield `[]` (not `undefined`). No auth test file exists today, so
+these invariants are unverified.
+
+**Context:** Surfaced during `/spec-review` of spec `001-canonical-role-constants`.
+The two "Session claim mapping" behavior scenarios are unchanged by that fix and
+were left untested (out of scope for the bug fix). Testing requires extracting
+the callback or mocking NextAuth, which is disproportionate for that spec.
+
+**Prerequisite:** None.