Review follow-ups for remote domains:
- Domain dialog probes {url}/auth/api/settings as the admin types:
reachability, rp-id match, and non-nesting (via a new remote flag in
the settings response) — warnings, never submit blockers
- Reject conflicting settings for domains sharing one remote;
sanitize aligns with a warning instead
- Forward profile/avatar requests (/auth/api/user/*) to the remote when
a remote domain's auth host reaches the satellite, never write locally
- Proxied calls answer 503 on transport errors (logout then deliberately
keeps the local replica session — the remote never saw it)
- Close forwarding httpx clients on reconcile removal and shutdown
- Clamp cache_ttl/refresh_interval server-side; syncfeed.emit is a true
no-op without subscribers; sync pump tolerates unexpected send errors
- Rebuild listeners: no running loop warns instead of raising, tasks are
strongly referenced and failures logged
- tests/test_satellite_e2e.py: live over-the-wire suite — real uvicorn
remote, real replica via reconcile: snapshot, events, write-behind,
token gate, TTL fail-closed, reconnect reconciliation
DB.session_ctx now reads only its own tables instead of struct
convenience properties that reach the global database, so a DB instance
(a read replica) is self-contained. session_ctx/session_context/
authz.verify/build_user_info take an explicit store parameter defaulting
to the local database; api.py endpoints resolve it from the dispatched
domain (Domain.store).
LeoVasanko