fix: harden m365 broker store zero value

Author: automagik-genie

.deadcode-baseline.txt

@@ -41,8 +41,8 @@ internal/googleauth/scopes.go:72:6: unreachable func: AllScopes
 internal/googleauth/scopes.go:96:6: unreachable func: knownCommandNames
 internal/msauth/broker_store.go:28:6: unreachable func: NewMemoryBrokerStore
 internal/msauth/broker_store.go:32:29: unreachable func: MemoryBrokerStore.Save
-internal/msauth/broker_store.go:46:29: unreachable func: MemoryBrokerStore.Consume
-internal/msauth/broker_store.go:72:6: unreachable func: ValidateBrokerAuthorizedEmail
+internal/msauth/broker_store.go:50:29: unreachable func: MemoryBrokerStore.Consume
+internal/msauth/broker_store.go:76:6: unreachable func: ValidateBrokerAuthorizedEmail
 internal/msauth/scopes.go:17:6: unreachable func: canonicalPilotScope
 internal/msauth/scopes.go:40:6: unreachable func: GuardPilotScopes
 internal/officetext/extract.go:46:6: unreachable func: ExtractTextByMIME

internal/msauth/broker_store.go

@@ -38,6 +38,10 @@ func (s *MemoryBrokerStore) Save(_ context.Context, session BrokerSession) error
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
+	if s.sessions == nil {
+		s.sessions = make(map[string]BrokerSession)
+	}
+
 	s.sessions[state] = session
 
 	return nil

internal/msauth/broker_store_test.go

@@ -30,6 +30,24 @@ func TestMemoryBrokerStoreConsumesSessionOnce(t *testing.T) {
 	}
 }
 
+func TestMemoryBrokerStoreZeroValueSaveInitializesSessionMap(t *testing.T) {
+	var store MemoryBrokerStore
+	session := BrokerSession{State: "state", ExpectedEmail: "pilot@example.com", ExpiresAt: time.Now().Add(time.Minute)}
+
+	if err := store.Save(context.Background(), session); err != nil {
+		t.Fatalf("save zero-value store: %v", err)
+	}
+
+	got, err := store.Consume(context.Background(), "state")
+	if err != nil {
+		t.Fatalf("consume zero-value store: %v", err)
+	}
+
+	if got.ExpectedEmail != "pilot@example.com" {
+		t.Fatalf("session = %#v", got)
+	}
+}
+
 func TestMemoryBrokerStoreRejectsExpiredSession(t *testing.T) {
 	store := NewMemoryBrokerStore()
 	session := BrokerSession{State: "expired", ExpectedEmail: "pilot@example.com", ExpiresAt: time.Now().Add(-time.Minute)}