backup: the Proton login runs from the workspace

:backup login <username> shows Proton's third-party disclosure (and a
warning when no session key file seals the stored session), asks for
the password, then for a two-factor code when the account has one. If
Proton answers with a human check, its own verify.proton.me page opens
in a sheet; the token it posts back resumes the login. :backup logout
forgets the session and ends it on Proton's side where Proton answers.
The mirror picks up a new session within a minute, without a restart.

The login is split into steps in backup::proton (start, second_factor,
verified), and a half-done login waits in memory for five minutes at
most. Every step goes through its own throttle, so the workspace cannot
hammer Proton into locking the account. FIDO2-only accounts are told to
add an authenticator app. The CLI runs over the same steps and points
to :backup login when Proton wants a human check. The CSP lets
verify.proton.me into a frame and nothing else.

.env.example

@@ -44,7 +44,8 @@ WORKSPACE_SECURE_COOKIE=0
 # WORKSPACE_SFTP_BIND=127.0.0.1:2222
 
 # --- Proton Drive backup -----------------------------------------------------
-# Off until `narl-workspace proton-login` stores a session under WORKSPACE_DATA_DIR.
+# Off until `:backup login <username>` in the workspace (or `narl-workspace
+# proton-login`) stores a session under WORKSPACE_DATA_DIR.
 # These only shape how often the mirror runs.
 
 # The device the server registers in Proton Drive; its sync root is the folder