fix(core,app,android,cli,packaging): harden account sign-in and watch-history sync

- Desktop shows Proton's CAPTCHA instead of failing the sign-in: a wry webview
  in a child process of the app (`pstr-app::verify`), confined to
  https://*.proton.me, hands the token back and the sign-in is retried. Linux
  packages and CI gain WebKitGTK 4.1; the Windows zip and MSI ship
  WebView2Loader.dll, without which a -gnu build does not start.
- The desktop keyring splits a secret too long for one entry across several,
  so a Proton session with many key salts survives Windows' 1280-unit cap.
  Short secrets stay one entry, so every existing secret still reads.
- `WatchSync` runs against a small `HistoryDrive` trait and is tested end to
  end against an in-memory Drive: two devices, newer wins, no re-upload of an
  unchanged history, a missing file written again, an unreadable own file
  never overwritten, a newer-format file left alone.
- An installation's file unwritten for 90 days is retired by the next device
  to sync, after its entries are merged and carried in that device's file.
- Removing a share keeps its watch state: sync would bring it back from the
  other devices anyway, and re-adding the share picks up where it left off.
- Watch history syncs once more on desktop exit (bounded to 3 s) and, on
  Android, through a WorkManager job enqueued when the app leaves the screen.
- The second-factor prompts say security keys are not supported.

packaging/PKGBUILD

@@ -23,7 +23,7 @@ license=('MIT')
 # mpv carries libmpv.so plus its headers on Arch, so it is both the runtime and
 # the build dependency. libsecret is the Secret Service side of the keyring —
 # the share fragment and custom password never touch shares.json.
-depends=('mpv' 'libsecret' 'hicolor-icon-theme')
+depends=('mpv' 'libsecret' 'webkit2gtk-4.1' 'hicolor-icon-theme')
 makedepends=('cargo')
 optdepends=('gnome-keyring: credential storage via Secret Service'
             'kwallet: credential storage via Secret Service on KDE')

packaging/README.md

@@ -40,6 +40,7 @@ are not Arch.
 |---|---|
 | **libmpv ≥ 0.34** | The player. `pstr-player` links it directly and drives it through `stream_cb`; nothing here shells out to `mpv(1)`, so packages depend on the library, not the player binary. |
 | **libsecret / Secret Service** | The share URL fragment and the custom password are secrets and live in the OS credential store, never in `shares.json`. |
+| **WebKitGTK 4.1** | The window Proton's CAPTCHA is shown in when it gates a sign-in (`pstr-app::verify`). The page reports success by posting a message to its host, so the system browser cannot stand in for it. |
 | **libGL, libxkbcommon, libX11, libwayland-client** | eframe on glow, with both display backends compiled in. |
 
 Not dependencies, deliberately: **SQLite** (rusqlite is `bundled`) and
@@ -47,11 +48,13 @@ Not dependencies, deliberately: **SQLite** (rusqlite is `bundled`) and
 
 Per packager that is:
 
-- Debian — `libmpv2 | libmpv1` (trixie | bookworm), `libsecret-1-0`, `libgl1`,
-  `libxkbcommon0`, `libx11-6`, `libwayland-client0`.
-- RPM — `mpv-libs`, `libsecret`, `mesa-libGL`, `libxkbcommon`, `libX11`,
-  `libwayland-client`.
-- Arch — `mpv` (which carries both `libmpv.so` and its headers), `libsecret`.
+- Debian — `libmpv2 | libmpv1` (trixie | bookworm), `libsecret-1-0`,
+  `libwebkit2gtk-4.1-0`, `libgl1`, `libxkbcommon0`, `libx11-6`,
+  `libwayland-client0`.
+- RPM — `mpv-libs`, `libsecret`, `webkit2gtk4.1`, `mesa-libGL`, `libxkbcommon`,
+  `libX11`, `libwayland-client`.
+- Arch — `mpv` (which carries both `libmpv.so` and its headers), `libsecret`,
+  `webkit2gtk-4.1`.
 
 The `.deb` and `.rpm` are built from binaries compiled on the packaging host, so
 they inherit its glibc. A package built on Arch installs on Fedora rawhide but
@@ -88,6 +91,13 @@ There is no static libmpv worth shipping, so **"standalone exe" means the exe
 plus `libmpv-2.dll` beside it** — that pair, plus `pstr.exe` and the README, is
 what the portable `.zip` contains and what the `.msi` installs.
 
+The cross build adds `WebView2Loader.dll` to that set. The CAPTCHA window runs
+on WebView2, and under `-gnu` `webview2-com-sys` links its loader as a DLL —
+without it beside the exe, the app does not start at all. `build-windows.sh`
+takes it from that crate's build output. An `-msvc` build links the loader
+statically and needs no DLL. The WebView2 *runtime* is part of Windows 10 and
+11 and is not shipped.
+
 The MSI needs the WiX toolset; the script installs it (`dotnet tool install
 --global wix`) and adds the UI extension if they are missing. It installs to
 `Program Files\Proton Stream`, puts a Start Menu shortcut on the GUI, and adds

packaging/proton-stream.spec

@@ -31,6 +31,7 @@ ExclusiveArch:  x86_64
 # `bundled`) and TLS is rustls, so neither shows up here.
 Requires:       mpv-libs >= 0.34
 Requires:       libsecret
+Requires:       webkit2gtk4.1
 Requires:       mesa-libGL
 Requires:       libxkbcommon
 Requires:       libX11

packaging/windows/proton-stream.wixl.wxs

@@ -149,6 +149,13 @@
             <File Id="MpvDll" Source="$(var.MpvDll)" Name="libmpv-2.dll" KeyPath="yes" />
           </Component>
 
+          <!-- Loads WebView2 for the CAPTCHA window Proton sometimes puts
+               in front of a sign-in. A -gnu build links it as a DLL; the
+               WebView2 runtime itself comes with Windows. -->
+          <Component Id="WebViewLoader" Guid="3e8a89cf-cf3e-4cc7-b1c6-9d272b3210c3" Win64="yes">
+            <File Id="WebViewLoader" Source="$(var.WebViewLoader)" Name="WebView2Loader.dll" KeyPath="yes" />
+          </Component>
+
           <Component Id="ReadMe" Guid="5bb65b44-f5df-423b-8dcc-a753d7aef565" Win64="yes">
             <File Id="ReadMe" Source="$(var.ReadMe)" Name="README.md" KeyPath="yes" />
           </Component>
@@ -162,6 +169,7 @@
       <ComponentRef Id="AppExe" />
       <ComponentRef Id="CliExe" />
       <ComponentRef Id="MpvDll" />
+      <ComponentRef Id="WebViewLoader" />
       <ComponentRef Id="ReadMe" />
     </Feature>