Add Project Home, Auth Bridge, shared auth token, and Tier-1 polish

Project Home (DESIGN-REVIEW §B2): the project is promoted from a 280px
sidebar card to a first-class main-area view. ProjectCard.tsx (1,257
lines) is replaced by a select-only ProjectRow plus tabs for Overview,
Sessions, Automation, Config and Files. The PortMappings, FileManager
and ContainerProgress modals are absorbed rather than reimplemented.
Config gains a Saved/Saving/Failed indicator — save-on-blur failures
previously reached only console.error.

Tier-1 polish (DESIGN-REVIEW §A): new elevation, muted-accent, disabled
and focus-ring tokens; a global :focus-visible ring with every
focus:outline-none removed; filled buttons moved to --accent-emphasis
and white-on-success toggles retired, fixing three WCAG AA failures
(2.1:1, 2.5:1, 2.4:1); a shared Modal primitive with role="dialog",
focus trap and restore, adopted by all remaining modals; status
indicators that carry a glyph and word rather than colour alone.

Ctrl+Shift+W closes a tab, deliberately not Ctrl+W — that is readline's
kill-word, used constantly in the terminal this app is built around.

Auth Bridge: a general loopback-callback bridge so browser logins run
inside a container (aws sso login, Concourse fly login, claude login)
can complete against the host browser. Listeners are discovered from
/proc/net/tcp{,6} — ss/netstat/lsof are absent from the image — bound on
host 127.0.0.1 only, and tunnelled in over the Docker API via socat,
which keeps working on Docker Desktop where container IPs are not
routable. Falls back to [::1] because Node resolves localhost to IPv6
first, so claude login often binds ::1 alone. Opt-in per project.

This extracts create_attached_exec() and moves the existing terminal
session path onto it, so there is one attached-exec implementation
rather than two.

Shared auth token: `claude setup-token` is run in a container, the token
is stored in the OS keychain and injected as CLAUDE_CODE_OAUTH_TOKEN
into Anthropic-backend projects. Contrary to the initial design note,
setup-token uses an Anthropic-hosted redirect and blocks on a stdin
paste prompt rather than a loopback callback, so a stdin command is
required for the flow to complete.

The token is never logged, never returned to the frontend, and is
redacted from the streamed output with a stateful matcher that withholds
any tail that could still grow into a secret. Change detection uses a
random rotation id rather than a hash, since a hash in a docker-inspect
readable label would be an offline verification oracle.

Frontend 33 -> 51 tests; Rust 34 tests. Both builds clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/src/lib/tauri-commands.ts

@@ -1,5 +1,5 @@
 import { invoke } from "@tauri-apps/api/core";
-import type { Project, ProjectPath, ContainerInfo, SiblingContainer, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, WebTerminalInfo, SttStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, SchedulerNotification } from "./types";
+import type { Project, ProjectPath, ContainerInfo, SiblingContainer, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, WebTerminalInfo, SttStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, SchedulerNotification, AuthBridgeStatus } from "./types";
 
 // Docker
 export const checkDocker = () => invoke<boolean>("check_docker");
@@ -133,3 +133,30 @@ export const getSchedulerNotifications = (projectId: string) =>
   invoke<SchedulerNotification[]>("get_scheduler_notifications", { projectId });
 export const clearSchedulerNotifications = (projectId: string) =>
   invoke<void>("clear_scheduler_notifications", { projectId });
+
+// Auth bridge — mirrors container loopback listeners onto host loopback so
+// browser OAuth logins started inside the container can complete.
+export const setAuthBridgeEnabled = (projectId: string, enabled: boolean) =>
+  invoke<AuthBridgeStatus>("set_auth_bridge_enabled", { projectId, enabled });
+export const getAuthBridgeStatus = (projectId: string) =>
+  invoke<AuthBridgeStatus>("get_auth_bridge_status", { projectId });
+
+// Shared Claude Code auth token — one `claude setup-token` run authenticates
+// every Anthropic-backend project. The token itself is never exposed here: it
+// lives in the OS keychain and is injected as a container env var.
+//
+// `acquireClaudeToken` borrows the given project's running container to run the
+// login (temporarily enabling its auth bridge), and streams progress on the
+// `claude-token-progress` and `claude-token-output` events. It resolves only
+// once the whole flow finishes, so call it without awaiting the UI on it.
+//
+// Partway through, `claude setup-token` prints a sign-in URL and then waits at
+// a "Paste code here" prompt: the user signs in, copies the code shown by
+// Anthropic, and it is delivered with `submitClaudeTokenCode`. One flow at a
+// time — a second `acquireClaudeToken` call rejects while one is in progress.
+export const acquireClaudeToken = (projectId: string) =>
+  invoke<void>("acquire_claude_token", { projectId });
+export const submitClaudeTokenCode = (code: string) =>
+  invoke<void>("submit_claude_token_code", { code });
+export const hasClaudeToken = () => invoke<boolean>("has_claude_token");
+export const clearClaudeToken = () => invoke<void>("clear_claude_token");