feat(auth): add headless OAuth login mode

[stefanosala]

Summary

• add auth login --headless so login can complete without a local callback listener
• print the OAuth authorization URL and accept a pasted callback URL containing code and state
• keep PKCE/state validation and token persistence aligned with the existing browser-based flow

Test plan

• cargo fmt
• cargo test
• cargo run -- auth login --headless (manual verification of headless prompt and callback handling)

Made with Cursor

[Copilot]

Pull request overview

Adds a headless OAuth login mode to vc-cli auth login so authentication can complete on hosts that can’t open a browser or run a local callback listener, while keeping PKCE/state validation and token persistence aligned with the existing flow.

Changes:

• Introduces --headless flag to print the authorization URL and prompt for a pasted redirect callback URL.
• Adds parsing/validation helpers for pasted callbacks and redirect URI path validation.
• Updates CLI docs/tests (README + skill docs) to describe and cover the new mode.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
src/commands/auth_login.rs	Implements headless pasteback flow, callback parsing, and redirect URI path validation; adds unit tests.
src/cli/mod.rs	Adds --headless flag wiring from clap CLI args into command execution; adds parsing test.
skills/vc-cli/SKILL.md	Documents auth login --headless behavior for agent usage.
README.md	Adds quick-start guidance and notes for headless login and skill docs location.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[stefanosala]

Addressed all unresolved review threads.

Fixed

• Skip listener timeout validation when --headless is used, so headless login no longer depends on --auth-listen-timeout-seconds.
• Refactor redirect URI validation into a shared parser used by both headless and listener flows to prevent drift.
• Reject redirect URIs with port 0 for both flows.

Not fixed

• None.

Validation

• cargo fmt
• cargo test (33 passed)

[stefanosala]

@copilot review

[Copilot]

@copilot review

All three review items are correctly addressed in commit f170417:

1. Timeout validation skipped for headless – resolve_listen_timeout(value, headless) returns Ok(None) immediately when headless is true, bypassing normalize_timeout entirely. The browser path then ok_or_else-unwraps the Option<u64> at the point it's actually needed, so neither path can misuse the other's value.

2. Shared redirect URI validator – parse_redirect_callback_target is the single source of truth for scheme, host, port, and path normalization. Both prompt_headless_callback (via redirect_target.expected_path) and bind_redirect_listener (which now accepts &RedirectCallbackTarget) consume the same pre-validated struct, so drift between the two paths is no longer possible.

3. Port 0 rejected – the explicit if port == 0 { return Err(...) } guard in parse_redirect_callback_target covers both flows simultaneously, and the new test asserts http://127.0.0.1:0/callback is rejected.

No issues found. The implementation is clean and cargo test confirms all 33 tests pass.