Add a controlled account-selection login flow for users who sign in with an account without a SimpleChat role.

[Xeelee33]

Summary

Current behavior: when a user logs into SimpleChat via SSO using an account that doesn't have a SimpleChat role the permission denied page does not provide any information about what account they are signed in as or give them a way to switch to a different account. This fix updates the permission denied page to show what account the user is trying to sign in as and provides a button that explicitly directs them to the account picker screen to choose the correct account.

• Adds a controlled /login?select_account=1 flow that requests the Microsoft Entra account picker without changing the normal sign-in experience or accepting arbitrary OAuth prompt values.
• Helps cross-cloud B2B users recover when Entra automatically selects a native Azure Government account that lacks the required SimpleChat app role.
• Shows the currently selected account on the access-denied page using safe session claims, while suppressing resource-tenant #EXT# UPNs.
• Improves the account-switch action’s contrast across light, dark, visited, hover, focus, and active states without changing role authorization semantics.

Updated access-denied page:

Linked issue

No linked issue.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• config.py VERSION third segment bumped to 0.261.030
• version.txt not needed because deployers was not changed

Testing / validation

• python functional_tests/test_cross_cloud_account_selection_login.py — 6/6 passed
• pytest test_cross_cloud_account_selection_login.py test_route_blueprint_policy_inventory.py test_route_unauthenticated_policy_contract.py test_route_policy_test_coverage.py -q — 14 passed
• Playwright verified the access-denied identity display, HTML escaping, account-selection URL, and WCAG AA dark-theme button contrast.
• Python compilation passed for the changed application and test files.
• python functional_tests/test_docs_site_quality.py — 6/6 passed
• git diff --check passed.

Documentation

• Release notes updated
• Feature documentation not needed
• Fix documentation updated in CROSS_CLOUD_ACCOUNT_SELECTION_LOGIN_FIX.md

Security checklist

• No new Flask routes were added; the existing /login route retains its Swagger security decorator.
• Settings sent to the non-admin landing page continue to use sanitize_settings_for_user().
• No browser JavaScript or CDN-hosted assets were added.
• No secrets, keys, connection strings, UPNs in URLs, login hints, or local-only artifacts are included.
• Session identity claims are rendered through Jinja auto-escaping, and #EXT# resource-tenant UPNs are not displayed.

[Paul Lizer (paullizer)]

Copilot resolve the merge conflicts in this pull request

[Paul Lizer (paullizer)]

Xeelee33 thats a great idea! please resolve pr conflicts and i will get this merged