Harden compliance portal auth and TLS

Align console references and OAuth branding with the
compliance-page model, and fix certificate cache eviction,
portal OAuth handlers, and magic-link edge cases left after
the trust-center rename.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/slug/slug_test.go

@@ -21,6 +21,7 @@
 package slug
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -91,4 +92,15 @@ func TestMakeWithEntropy(t *testing.T) {
 			assert.NotEqual(t, first, second, "MakeWithEntropy should produce distinct slugs")
 		},
 	)
+
+	t.Run(
+		"long names stay within dns label length",
+		func(t *testing.T) {
+			t.Parallel()
+
+			got := MakeWithEntropy(strings.Repeat("Very Long Organization Name ", 10))
+			assert.LessOrEqual(t, len(got), 63)
+			assert.Regexp(t, `^[a-z0-9-]+-[0-9a-f]{8}$`, got)
+		},
+	)
 }