Answer
Grant FND_WEBENDUSER_MAIN instead of FND_ADMIN — it's the standard end-user permission set for basic Aurena access, and it already contains the specific functional permission set (FND_WEBRUNTIME) required to log into Aurena in the first place, without the broad administrative access that comes with FND_ADMIN.