feat(webui): device-authorization login, a sign-out that signs out, and account switching (N)

[stevenjj33]

Change

Roadmap N（登录与账号）: the two 🟡 rows — 登录方式 and 登出·账号切换（身份展示 ✅ untouched）. Baseline: webui @ e35940c (verified against the fetched origin/webui HEAD at start of work, matching the number read at 22:33).

What was actually wrong (both reproduced/read before any change):

1. No login at all. The WebUI served whatever OAuth credential mcode login (or the desktop) had already written into the shared store. The usage panel literally said 「登录后查看用量」 with no way to log in; after a sign-out the only way back was leaving the browser.
2. 退出登录 didn't sign out. The button ran the host's invalidateAuth, which clears the cli-auth projection and the in-process context — the OAuth credential itself survived, and the next lease refresh (refreshOAuthAuthContext) re-authenticated immediately. Neither row could work while the credential was undeletable from the UI.

The fix — one surface, server-first:

• Server (account-login.ts + assembly): the assembly already builds one MCodeOAuthCore for quota leases; the account session wraps the same core — one credential store, one watch. beginAccountLogin starts (or re-attaches to — the core dedupes login() on its own promise) a device-authorization login, the same flow the terminal client uses, and resolves with the prompt (user code + verification URL) without waiting for the human. getAccountLoginStatus folds the settled outcome / in-flight prompt / persisted store (a terminal-client login counts). cancelAccountLogin aborts without recording the cancellation as a failure.
• signOut fixed: the operation now prefers signOutAccount → quotaOauthCore.logout({revoke: true}) (revoke server-side + remove the credential) followed by the existing invalidation; hosts assembled before this change fall back to the historical behaviour instead of failing.
• 账号切换: from the authenticated state the same dialog offers 切换账号 — sign out (for real), then begin a fresh device flow in the same surface. With a single-credential store this is the honest switch.
• Client: AccountLoginDialog (portal dialog; the pure AccountLoginPanel is separately testable) — device code, authorization link (complete URI when provided), 2s poll, cancel, expired retry. Two entries: the user menu's 「账号与登录」 item, and a 登录 button in the usage panel's signed-out block.
• A real-user bug found by the browser spec, fixed here: the usage panel's 登录 button ate first clicks — mousedown gave it focus, focusin re-triggered the anchor's onFocus → loadUsage, whose loading skeleton replaced the pressed node mid-click, and Chromium does not dispatch click when the mousedown node is disconnected (event-trace reproduced). The button now prevents mousedown default; the comment in UserMenu.tsx explains the chain.

Validation

• pnpm test:webui — 91 files / 1750 tests passed, including new account-login.test.ts (7: prompt-on-begin, re-attach without a second login call, settled outcome, cancellation-is-not-failure, persisted-store status, phase derivation).
• npx playwright test — 93/93 passed, including new account-login.spec.mjs (4, harness-imported test): the full device flow with authorization completing via the poll; 切换账号 issuing signOut before the new device flow; the usage-panel entry (which also covers the first-click fix); cancel closing and cancelling.
• pnpm typecheck:webui-full, pnpm check:source (inventory regenerated), pnpm verify — passed, 20 gates on darwin.
• Port stubs in webui-service.test.ts / webui-host-shape-invariant.test.ts grow the four members (the invariant class exists precisely to make a forgotten member a compile error).

NOT RUN / boundaries

• The credential round trip itself (real OAuth server, human at the authorization page) was not exercised: the fixture's login operations are synthetic. What is verified is the browser half — entries, phases, polling, switch path issuing sign-out first — and the server session against a fake core following the MCodeOAuthCore contract (login/cancelLogin/logout/getStatus, source-read). No live-service acceptance claimed.
• 身份展示 (✅) untouched.

Publication and contribution checks

• I have permission to contribute these changes under the existing licenses applicable to the changed files/packages; imported material and its provenance are identified and existing notices are preserved.
• No credentials, account data, real user content, internal source history or private review material is included.
• Added/removed source files were reviewed before regenerating release/public-source.json; new tests are declared in test/vitest-suites.json where applicable.
• Shared English/Chinese documentation and capability/verification records are updated where applicable. Mock/offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope or license changes (if any): none.

Shared-source port: not needed.