feat(login): sign in to Entra ID with no screen — in the terminal, or in a browser over the tailnet

[theophile-wallez]

Sign in to Entra ID on a host with no screen — in the terminal, or in a browser over your tailnet. One feature, two viewers over the same private display.

(This supersedes #5, which is closed: both viewers are here now.)

Why

A headless host still has to sign in interactively. The broker's Primary Refresh Token
expires, Entra answers interaction_required, and every token call fails until a human
completes a sign-in. Over SSH there was no way to do that.

There is no text-only path either: the broker refuses a device-code flow on Linux
(AcquireTokenWithDeviceCodeFlow is not implemented on Linux platform) and renders the
sign-in itself, in an embedded WebKitGTK view on an X display. The window has to
exist — so this brings it to you instead of replacing it.

intune-container login              # drawn in your terminal; account remembered → straight to Authenticator
intune-container login --fill       # ask for address + password and type them
intune-container login --manual     # touch nothing, drive the window by hand
intune-container login --web        # serve it to a browser on your tailnet, at full resolution

The shared half

• xvfb.rs — a private invisible display, owned for the session.
• ops::portal_start — runs the Intune portal on it (the enroll flow, split so the
  caller can drive the window between steps).
• xscreen.rs — reads pixels with GetImage, sends keys and clicks with XTEST.
• The command drives the sign-in itself: it presses Sign in and fills credentials
  when asked for them. There is no DOM behind that window, so every step is timed on
  the picture — act, wait for movement, wait for it to settle.
• Teardown is one path for both viewers: the portal closes, the container returns to
  headless, the X server stops — including on a dropped SSH connection.

Viewer 1 — the terminal (termview.rs)

Half-block cells, one repaint sending only the cells that changed. F1 help,
F2 zoom, F4 fit, Ctrl+arrows pan, Ctrl+Q quit. Needs a terminal with
24-bit colour and nothing else — no VNC server, no compositor, no X forwarding.

Viewer 2 — the browser (webview.rs)

Half-block cells cost half the vertical resolution, and 13-pixel text survives that
only when you zoom. --web serves the same display to a browser at its own size, with
a real pointer and Ctrl+V for a password out of a manager. One thread, no async
runtime, no WebSocket, no new crate:

• GET /delta — the 32-pixel tiles that changed since the sequence number the client
  holds, gzipped, so the browser inflates it and the page needs no decoder. A stale
  sequence number gets a whole frame, the only right answer after a missed update.
• POST /input — one request per keystroke, so a key never waits for a frame.
• poll(2) over the listener and the open sockets keeps those independent without a
  thread each, and without a partial-write queue.
• It binds this host's tailnet address, read from getifaddrs rather than from the
  tailscale command, and falls back to loopback with the ssh -L line to reach it.
  --bind and --port override both.
• Every request must carry a 128-bit token minted per session from /dev/urandom and
  printed once. Without it the socket is open to every other device in the tailnet
  while a password is typed.

Testing

cargo fmt --all --check, cargo clippy --all-targets -- -D warnings,
cargo test --locked (74 tests) and cargo build --release --locked all pass.

Against the real tenant. The portal opens, the button is clicked, and Entra reaches
"Approve sign in" with a number-matching code on screen and a request on the phone. A
login run killed mid-session leaves getAccounts working and a Graph token mintable;
before 2b26217 it left the account signed out.

Against a real display (ignored tests; need Xvfb and xterm):

• typing_reaches_a_window_on_a_real_display — the capture comes back with the right
  pixel format, and a typed line reaches a window that is not ours.
• a_browser_client_sees_the_display_and_types_into_it — drives the whole HTTP server:
  a wrong token and a missing one are refused, the first delta is the whole display, a
  white pixel proves the tiles carry it, a typed line lands, and Finish ends the session.

Against a real browser. The same server in Chromium: the window drew sharp at
1024×768, keystrokes arrived in it, and Finish returned the session with the X server
and the window cleaned up.

Failure modes found while proving it, each now covered

• a display socket is bound before the server listens → the first connection was refused;
• SIGKILL on teardown left socket and lock behind → the next run found an unusable
  display number;
• with no window manager the dialog mapped at 615,375, putting Sign in past the
  bottom edge → place_and_focus moves it to the origin;
• O_NONBLOCK on stdin also applies to stdout → a frame larger than the tty buffer died
  with EAGAIN; input is polled instead;
• Enter alone does nothing (no GTK default button), and Tab's focus ring moved ~3% of
  pixels and read as a click → the "new page" threshold is 15%;
• place_and_focus moves the window, so measuring the button before placing it clicked
  the old position → the click is measured after placement, keyboard as fallback;
• the container's session profile publishes DISPLAY into the D-Bus activation
  environment, so a login session left the broker on DISPLAY=:77 after its Xvfb was
  gone. Every token call answered NoReply — the same signature as a locked keyring,
  which is what the banner blamed while doctor reported all six checks passing
  (2b26217);
• the page read the flags and the tile count at the header offsets they had before
  width and height were added → it drew the height as flags. Both sides of that
  header are now asserted;
• /favicon.ico carries no token, so the 403 left a console error that reads like a
  fault. It is answered empty, ahead of the check.

Two commits that are not the feature

• 365aaa7 — fmt and lints only. The three files this branch touched were committed
  unformatted, and stable clippy has since grown manual_div_ceil and
  redundant_closure, which fire on them. CI failed on both gates before this.
• 9ec38c3 — merge of master at v0.2.2, which the branch predated. One real
  conflict, in provision.rs, and a genuine collision of intent: master made the
  container's :99 a transient user unit with Restart=always (a child of the setns
  exec dies with that exec's cgroup), while this branch had extracted the same block
  into BROKER_DISPLAY_SCRIPT so a sign-in can run it again on the way out. Both are
  kept — the const holds the supervised version, and running it twice is a no-op by
  construction (is-active), which is all the sign-in needs.

[theophile-wallez]

@magicabdel ready for your review when you have a moment. Three commits, all verified live against the real tenant — the last one (2b26217) is the important fix: without it a terminal sign-in leaves the broker on the ephemeral display and the account drops minutes later.

[magicabdel]

niice, maybe we can add a background login tokio task that will run just before the primary token expires => ensures a fresh token is always present