feat: consume embedded-handoff ZeroID token from URL hash (skip sign-in when framed)

[saucam]

Problem

When codeoid's web UI is embedded by a host app (Highflame Studio's Agent Sandbox), the host has already authenticated the user and hands off a short-lived ZeroID token in the iframe URL hash — …/ui/#codeoid_token=<jwt>. But the web UI ignored it and rendered codeoid's own sign-in page inside the frame, so the "SSO" experience dead-ended at a login screen.

Fix

main.tsx now calls a new consumeEmbedToken() before the app boots:

• Runs only when actually framed (window.parent !== window). At the top level ("Open in new tab") it's a no-op, so a token is never consumed outside the embed path.
• Reads #codeoid_token from the hash, stores it in the OAuth-token slot (codeoid.token) via rememberOAuthToken() — so resolveToken() picks it up through its existing OAuth-token fallback and reloads stay signed in.
• Scrubs the token from the address bar / history (replaceState), preserving any other hash state.

Security: the token is a normal ZeroID JWT the daemon still verifies on every WebSocket (JWKS signature, mandatory account_id/project_id, per-message expiry). This only skips the interactive sign-in; it does not bypass authorization.

Companion changes (Highflame side)

• Studio already passes #codeoid_token when framing (highflame-studio).
• Forge injects the ZeroID URL so the daemon's JWKS verification resolves.

Follow-ups (hardening, not required for this to work)

• Daemon: enforce audience=codeoid and set frame-ancestors / CODEOID_EMBED_ALLOWED_ORIGINS to restrict which hosts may embed (clickjacking) — framing is currently open.

Test

• web: vitest run src/lib/auth.test.ts → 25 passed (5 new: stores+scrubs when framed, resolveToken picks it up, preserves other hash state, no-op at top level, no-op without a token)
• tsc -b --noEmit ✅ · eslint src ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.02%. Comparing base (e0f2f9e) to head (3e351b4).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #210   +/-   ##
=======================================
  Coverage   88.02%   88.02%           
=======================================
  Files         129      129           
  Lines       22045    22045           
=======================================
  Hits        19405    19405           
  Misses       2640     2640           

Flag	Coverage Δ
daemon	88.02% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.