[hsmith-dev]

Stacked on #13.

Adds sign-in through the homeserver's identity provider (Google, GitHub, company OIDC/SAML, CAS, or a Matrix Authentication Service via its m.login.sso compatibility layer).

• Desktop: ChatCraft listens once on 127.0.0.1 at a random port and opens the SSO page in the system browser. The login token comes back to that listener, which gives up after five minutes or when you cancel.
• Web: the page redirects to the SSO page itself. On return it accepts ?loginToken= only for a sign-on this tab started (the pending account waits in sessionStorage) and removes the token from the address bar.
• Safety: the token is single-use and never remembered. If the identity provider signed in someone other than the username entered, the device is signed out and its store deleted.
• UI: a "Sign in with single sign-on" button and a "continue in your browser" card with Cancel.
• Desktop links: turned on egui-winit's links feature. Message links now open in the browser too; before this, open_url did nothing on the desktop.
• Docs: docs/matrix.md › Single sign-on and Testing (stub CAS setup), plus gaps and ROADMAP.

Not yet supported: OIDC-native-only homeservers (MSC3861 without m.login.sso), and browser confirmation (UIA fallback) for cross-signing when the server requires it after SSO.

Testing

• cargo xtask ci: all 7 steps pass.
• cargo test -p chatcraft-matrix against Synapse with a stub CAS provider: 20 unit tests and 12 integration tests pass. The new tests/sso.rs uses curl -L as the browser and covers sign-in, resume, single use, and refusal of a mismatched user with cleanup.
• Shell tests cover the token, failure and cancel paths.
• Checked by hand in headless Chrome: the page went to Synapse, through CAS and back, signed in, and the token was removed from the URL.

🤖 Generated with Claude Code