v2.0a3

Added

• Git authentication via the browser for Gitea hosts (#3385). A
  KLANGKWS_FEATURE_OAUTH_PROVIDERS entry with
  flow: authorization_code_pkce runs the OAuth authorization-code
  flow with PKCE (S256) for hosts like Gitea that implement no device
  flow: the first git clone opens an authorization popup, approval
  happens on the Gitea page, and the tab session refreshes the token
  headlessly afterwards. The operator registers a public OAuth
  application in Gitea's user settings pointing at the klangk origin;
  see the new Gitea docs chapter. GitHub and GitLab device
  flows are unchanged.

• PyPI project links (#3369). The klangk wheel now carries
  project.urls — Homepage, Documentation, Repository, Issues, and
  Changelog — so the PyPI project and release pages show the sidebar
  links. Changelog points at the docs-rendered changelog page.

Changed

• dart format pre-commit hook verifies instead of rewriting
  (#3376). The hook now runs dart format --output=none --set-exit-if-changed via scripts/dart-format-verify.sh and fails
  on unformatted files instead of silently rewriting them mid-commit —
  rewrite mode flipped short→tall style in fresh worktrees (where no
  .dart_tool exists to resolve the language version) and wedged prek's
  stash rollback during cherry-picks. Files whose package has no
  .dart_tool yet are skipped with a notice; run dart format yourself
  before committing. The frontend CI workflow now checks formatting
  after pub get (src/frontend lib+test and every feature package
  with tests), and the five files that were off-canonical at the pinned
  language version were reformatted.

Fixed

• SSO login completes under an every-visit login banner
  (#3371). With login_banner_every_visit on, the browser's
  return from the identity provider carried a one-time login code
  that the banner gate discarded by redirecting to the consent page
  first, so single sign-on could never finish (the code expires in 60
  seconds and the redirect replaces the URL). The OIDC callback page
  now redeems the code before the banner is shown, and the user is
  sent to the consent page on the next navigation as usual. A failed
  code exchange shows the error with a “Go to Login” button instead
  of stranding the browser on the callback page.