OIDC sign-in: robust after_action for get? result, non-bang role sync

- sign_in_with_rauthy after_action normalizes result (nil/struct/list) to list before Enum.each.
- OidcRoleSync.do_set_role uses Ash.update and swallows errors so auth is not blocked; skip update if role already correct.

lib/mv/oidc_role_sync.ex

@@ -132,11 +132,17 @@ defmodule Mv.OidcRoleSync do
   end
 
   defp do_set_role(user, role) do
-    user
-    |> Ash.Changeset.for_update(:set_role_from_oidc_sync, %{role_id: role.id})
-    |> Ash.Changeset.set_context(%{private: %{oidc_role_sync: true}})
-    |> Ash.update!(domain: Mv.Accounts, context: %{private: %{oidc_role_sync: true}})
-
-    :ok
+    if user.role_id == role.id do
+      :ok
+    else
+      user
+      |> Ash.Changeset.for_update(:set_role_from_oidc_sync, %{role_id: role.id})
+      |> Ash.Changeset.set_context(%{private: %{oidc_role_sync: true}})
+      |> Ash.update(domain: Mv.Accounts, context: %{private: %{oidc_role_sync: true}})
+      |> case do
+        {:ok, _} -> :ok
+        {:error, _} -> :ok
+      end
+    end
   end
 end