test(#411): QA-014 — add verifySession non-Error thrown value tests

Verify verifySession returns null when getSession throws non-Error
values (strings, objects) rather than crashing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/auth/auth.service.spec.ts

@@ -278,7 +278,7 @@ describe("AuthService", () => {
 
       expect(loggerError).toHaveBeenCalledTimes(1);
       expect(loggerError).toHaveBeenCalledWith(
-        expect.stringContaining("OIDC provider unreachable"),
+        expect.stringContaining("OIDC provider unreachable")
       );
     });
 
@@ -305,7 +305,7 @@ describe("AuthService", () => {
 
       expect(loggerError).toHaveBeenCalledTimes(1);
       expect(loggerError).toHaveBeenCalledWith(
-        expect.stringContaining("OIDC provider returned non-OK status"),
+        expect.stringContaining("OIDC provider returned non-OK status")
       );
     });
 
@@ -332,7 +332,7 @@ describe("AuthService", () => {
 
       expect(result).toBe(true);
       expect(loggerLog).toHaveBeenCalledWith(
-        expect.stringContaining("OIDC provider recovered after 2 consecutive failure(s)"),
+        expect.stringContaining("OIDC provider recovered after 2 consecutive failure(s)")
       );
       // Verify counter reset
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -495,6 +495,26 @@ describe("AuthService", () => {
       expect(result).toBeNull();
     });
 
+    it("should return null when getSession throws a non-Error value (string)", async () => {
+      const auth = service.getAuth();
+      const mockGetSession = vi.fn().mockRejectedValue("some error");
+      auth.api = { getSession: mockGetSession } as any;
+
+      const result = await service.verifySession("any-token");
+
+      expect(result).toBeNull();
+    });
+
+    it("should return null when getSession throws a non-Error value (object)", async () => {
+      const auth = service.getAuth();
+      const mockGetSession = vi.fn().mockRejectedValue({ code: "ERR_UNKNOWN" });
+      auth.api = { getSession: mockGetSession } as any;
+
+      const result = await service.verifySession("any-token");
+
+      expect(result).toBeNull();
+    });
+
     it("should re-throw unexpected errors that are not known auth errors", async () => {
       const auth = service.getAuth();
       const mockGetSession = vi.fn().mockRejectedValue(new Error("Verification failed"));