TDD step 9: Login view override + specs

Replaces ActiveAdmin's stock email/password login with an SSO-only
button that POSTs to the OmniAuth entry point. The view ships inside
the gem's app/views tree and the engine prepends that path onto
ActiveAdmin::Devise::SessionsController so the override wins over
ActiveAdmin's own template. Button label is configurable; default
comes from Configuration::DEFAULT_LOGIN_BUTTON_LABEL.

Author: Fivell

app/views/active_admin/devise/sessions/new.html.erb

@@ -0,0 +1,9 @@
+<div id="login">
+  <h2><%= active_admin_application.site_title(self) %></h2>
+
+  <%= button_to ActiveAdmin::Oidc.config.login_button_label,
+                "/admin/auth/oidc",
+                method: :post,
+                class: "activeadmin-oidc-login-button",
+                data: { turbo: false } %>
+</div>

lib/activeadmin/oidc/engine.rb

@@ -40,6 +40,18 @@ def controllers
           end
         end
       end
+
+      # Make sure the gem's login view override wins over ActiveAdmin's
+      # default. ActiveAdmin's view path is registered when its engine
+      # initializes; we prepend ours in `to_prepare` so it lands in front
+      # of ActiveAdmin's Devise::SessionsController view lookup.
+      initializer "activeadmin_oidc.prepend_view_paths" do |app|
+        app.config.to_prepare do
+          require "active_admin/devise"
+          view_path = File.expand_path("../../../app/views", __dir__)
+          ::ActiveAdmin::Devise::SessionsController.prepend_view_path(view_path)
+        end
+      end
     end
   end
 end

spec/requests/login_page_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+# The gem replaces ActiveAdmin's stock email/password login page with an
+# SSO-only button. This spec verifies the view override is picked up
+# through the engine's view path and that the button label is sourced
+# from configuration.
+RSpec.describe "Login page", type: :request do
+  before do
+    ActiveAdmin::Oidc.configure do |c|
+      c.issuer    = "https://idp.example.com"
+      c.client_id = "client-abc"
+      c.on_login  = ->(*) { true }
+    end
+  end
+
+  it "renders the SSO button with the configured label" do
+    ActiveAdmin::Oidc.config.login_button_label = "Sign in with Corporate SSO"
+
+    get "/admin/login"
+
+    expect(response).to have_http_status(:ok)
+    expect(response.body).to include("Sign in with Corporate SSO")
+    expect(response.body).to include(%(action="/admin/auth/oidc"))
+  end
+
+  it "does not render email or password fields" do
+    get "/admin/login"
+
+    expect(response.body).not_to match(/name="admin_user\[password\]"/)
+    expect(response.body).not_to match(/name="admin_user\[email\]"/)
+  end
+
+  it "uses the default login button label when not configured" do
+    get "/admin/login"
+
+    expect(response.body).to include(ActiveAdmin::Oidc::Configuration::DEFAULT_LOGIN_BUTTON_LABEL)
+  end
+end