feat(auth): integrate UC native login and managed client updates

[loveRhythm1990]

Summary

Add opt-in UC browser sign-in for native Astra clients, sharing one credential owner with MOI CLI while keeping model credentials server-side. This draft collects the cross-project native-client integration and its review fixes.

• Discover the server's sign-in method for both astra login and TUI /login; retain existing Memoria and self-hosted authentication paths.
• Own environment-scoped native sessions, PKCE callbacks, validated token rotation, logout and the short-lived credential helper in astra-credentials / CLI authentication.
• Resolve UC identity and Genesis model policy on the server; retain built-in memory isolation without requiring a separate interactive memory login.
• Integrate managed installation leases, update delegation and non-interactive-safe update notices for Astra and Edge. The companion installer/updater owns artifact distribution and activation.
• Repair login UI lifecycle, materialization registration, session admission and banner rendering regressions; adapt upstream permission-mode requests to asynchronous credentials.

Related issue

Related cross-project requirement: matrixorigin/matrixflow#17209.

Change type

• Feature
• Bug fix
• Documentation
• Refactor or performance improvement
• Test
• Build, CI, or maintenance

User and compatibility impact

UC-native mode requires explicit server configuration and a matching UC deployment. Non-UC deployments keep their existing login provider. Native credentials are scoped by environment; Genesis runtime PATs and resource-service secrets are not distributed to local clients. Client working directories remain user-selected.

Managed binaries delegate updates to the companion MOI updater; standalone/unmanaged installations retain their existing execution path. This draft does not publish binaries or deploy services. The accumulated client change also advances the workspace version to 0.2.7.

Architecture and complexity delta

• Canonical owner changed or extended: astra-credentials owns native session storage/rotation; service auth owns server-side UC validation; core installation support owns client leases and updater invocation.
• Existing implementations and callers searched: CLI and TUI login, thin-client headers, Edge reconnect, session admission, memory prefetch/compaction/reflection and server model selection.
• Superseded code, states, tables, shims, or self-only tests removed: duplicated caller-side token refresh is avoided; the CLI helper uses the same native credential owner. Permission-mode APIs now await this existing header path.
• If parallel implementations remain, their boundary and retirement condition: Memoria/self-hosted login intentionally remains for non-UC deployments; it is selected by server discovery, not mixed into UC sessions. No retirement is planned.

Verification

Commands run from the Astra repository on the rebased current branch:

env CARGO_INCREMENTAL=0 CARGO_BUILD_JOBS=2 make format-check lint
PASS (Clippy all targets)

env CARGO_INCREMENTAL=0 CARGO_BUILD_JOBS=2 cargo nextest run --locked --profile strict --test-threads 2 -p astra-core -p astra-credentials -p astra-thin-client -p astra-cli -p astra-edge -p astra-services -p astra-runtime --lib -E 'test(native) | test(client_installation) | test(uc_) | test(genesis) | test(auth_flow) | test(login_control) | test(login_discovery) | test(permission_mode_request_and_snapshot) | test(session_execution_lease) | test(weighted_admission) | test(banner) | test(materialization)'
150 PASS

env CARGO_INCREMENTAL=0 CARGO_BUILD_JOBS=2 cargo nextest run --locked --profile strict --test-threads 2 -p astra-cli --test native_auth_environment -p astra-runtime --test uc_builtin_memory_http --test http_contract -p astra-edge --bin astra-edge
65 PASS, 1 existing ignored live-database case

git diff --check 13a10c27...HEAD
PASS

• Public entrypoint exercised: native CLI subprocess environment tests, HTTP contract tests and Edge binary tests; companion real-binary updater integration was also run in an isolated temporary HOME before the final rebase (not a substitute for current-head browser/LLM acceptance).
• Unhappy paths exercised: discovery failures, credential isolation/rotation, login cancellation, managed-client lock/activation boundaries, rejected admission and invalid materializations.
• Database verification: the real built-in-memory HTTP/database case remains ignored without its opt-in fixture. Its helper/isolation tests passed; this is not evidence of a live memory round-trip.
• Not run in this pass: full offline suite, live provider/browser signup-to-chat journey, all four native target platforms, live database integration. Focused tests run on macOS; live and cross-platform acceptance is still required.

Final checklist

• I added or updated tests at the layer that owns the behavior, or explained why no test is needed.
• I updated public or design documentation for contract changes, or the change needs no documentation update.
• I checked the diff for credentials, private URLs, customer data, generated files, and other sensitive information.
• The PR title follows the repository's Conventional Commit format.