[LIghtJUNction]

Problem

System-browser login and a native WebView use separate cookie stores. Opening Google in the browser does not sign the app in. A safe return must not put a long-lived session into a URL, JavaScript storage or native command.

Changes

• Add a five-minute app request bound to a random HttpOnly, SameSite=Strict initiating-cookie proof. Public request IDs and comparison numbers have no redemption authority.
• Require explicit browser consent with the current account, matching comparison number, exact Origin and CSRF protection. Google returns only to the fixed confirmation route; email OTP also works there.
• Let only the initiating WebView redeem once, atomically, into a normal HttpOnly session. The fixed hireferry://login-return link merely wakes the app; no credentials or server address travel through it.
• Recheck source-session validity, suspension and actual staff/manager membership during approval and redemption. Operator sessions must sign in directly in the app.
• Preserve source authentication age and cap the new session at the source expiry.
• Handle cancellation while a poll is hung or already committed: revoke only the newly issued app session, preserve the browser session, and ignore a late success response after cancellation.
• Add an atomic, idempotent feature-table migration with no reuse or bump of schema version 13. Failed index creation rolls back cleanly and is retryable.

Evidence

• Existing authentication/library/CLI + new app-login run: 78 passed (19 library, 10 auth-flow, 35 CLI, 14 app-login).
• Final app-login suite including atomic migration regression: 15 passed.
• Actual Rust server + temporary SQLite + two independent Chromium contexts: 8 acceptance groups passed. Covers explicit consent, proof isolation, public-ID rejection, one-time redemption, preserved source session/auth age, real development OTP, denial, cancellation-before-ACK and cancellation-after-commit with a delayed response.
• Both pages passed Chinese/English layout checks at 320 and 390 px. JavaScript syntax, formatting and whitespace checks passed.

Integration and limitations

Based on latest main 1345338, preserving HF-QA-001 and the GitHub/star/CSP work. Native navigation and fixed OS wake-up handling are in #21. The server and client should be accepted together; this PR's browser verification does not claim Android/iOS OS-level wake-up or live Google-account verification. Existing Google OAuth credentials and actual device/platform validation are still required.

A combined integration branch will also verify schema-13 upgrades with #19's additive relation tables, repeated migrations and permissions on the same code tree. No production session, real feedback or business data was used.