Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@selfservice/flow/login/hook_external_id_test.go`:
- Line 79: Remove the no-op invocation fakeHydra.Params() in the test since its
return value is discarded and it has no side effects; locate the call in the
test file (look for fakeHydra.Params() in login/hook_external_id_test.go) and
delete that statement, then run the unit tests to ensure nothing else depended
on its return value.
- Around line 111-112: The test in hook_external_id_test.go currently uses a
loose require.Error(t, err); tighten it to assert the specific failure by
replacing that call with a precise check such as require.ErrorIs(t, err,
expectedErr) (using the package sentinel error, e.g., ErrExternalIDNotFound) or
require.EqualError(t, err, "expected error message") or assert.Contains(t,
err.Error(), "missing external id") so the test verifies the exact reason for
failure; locate the failing test by the err variable in hook_external_id_test.go
and use the appropriate sentinel error or explicit message from the code under
test.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@selfservice/flow/login/hook_external_id_test.go`:
- Around line 91-112: The test currently only checks require.Error(t, err) after
calling reg.LoginHookExecutor().PostLoginHook which can hide unrelated failures;
change the assertion to validate the specific bad-request/validation error for
the external_id subject_source path by asserting the error type and
reason/message contains the expected validation indicator (e.g., "external_id"
or "subject_source") so the test fails only if the hook does not return the
expected validation error; locate the assertion after the PostLoginHook call in
the test case and replace the generic require.Error check with an assertion that
the error is the expected bad-request/validation error (using the project’s
error-type helper or by checking error string/reason).

---

Nitpick comments:
In `@hydra/fake.go`:
- Around line 29-31: The Params() method on FakeHydra currently returns the
backing slice h.params allowing external mutation; change Params() to return a
defensive copy by allocating a new slice of len(h.params) and copying h.params
into it (e.g., make([]AcceptLoginRequestParams, len(h.params)) + copy or append)
so callers receive an independent slice; update the method on the FakeHydra type
to perform this copy before returning.

In `@selfservice/flow/login/hook_external_id_test.go`:
- Around line 47-89: The two subtests share mutable fakeHydra state so
fakeHydra.Params() accumulates across runs; make each t.Run independent by
either instantiating a fresh fakeHydra inside each subtest (or calling a reset
method on fakeHydra) before invoking reg.LoginHookExecutor().PostLoginHook, and
remove the stray fakeHydra.Params() call that was intended to clear state;
ensure assertions in each case (checking fakeHydra.Params() length or using
lastParams) operate on the fresh/reset fakeHydra so tests don't depend on prior
runs.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@embedx/config.schema.json`:
- Around line 2289-2294: The schema description for the "subject_source"
property currently claims a hard error when "external_id" is missing; update the
description to reflect the actual fallback behavior (use the identity UUID/"id"
when external_id is unset) so the config contract matches runtime semantics.
Locate the "subject_source" JSON schema entry and replace the description text
to state that "external_id" will be used when present otherwise the system falls
back to the identity "id" (no error), and keep the enum/default values
unchanged.

In `@hydra/fake.go`:
- Around line 53-56: The fake hydra implementation currently returns a hard
error in the "external_id" case when params.ExternalID is empty; change this to
mirror real Hydra's fallback behavior by returning a derived subject instead of
failing — detect if params.ExternalID == "" and then return params.Subject (or
another existing identifier field used as the OAuth2 subject in this fake) as
the fallback value; update the switch/case handling in fake.go (the
"external_id" branch) to use params.ExternalID when present and fall back to
params.Subject (or the equivalent identifier field) when not, rather than
returning herodot.ErrBadRequest.