feat(device): prefill device auth flow

[IvGolovach]

Prefill the device auth flow so users do not have to re-enter the code after signing in.

This adds verificationUrlComplete to the device auth API, updates the CLI to use it when available, and lets the web device page pick up the prefilled ?code=... value across the sign-in redirect.

The existing flow still works as a fallback when the server does not return verificationUrlComplete.

Checks:

• cargo test -p tokscale-cli auth::tests -- --nocapture
• cargo test -p tokscale-cli --bin tokscale
• cd packages/frontend && ../../.bun/bin/bun x vitest run __tests__/lib/device.test.ts __tests__/api/device.test.ts
• cd packages/frontend && ../../.bun/bin/bun x vitest run
• cd packages/frontend && ../../.bun/bin/bun x tsc --noEmit

[vercel]

@IvGolovach is attempting to deploy a commit to the Inevitable Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

1 issue found across 6 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/tokscale-cli/src/auth.rs">

<violation number="1" location="crates/tokscale-cli/src/auth.rs:213">
P2: On Windows, `open_browser` uses `cmd /C start` with an unquoted URL. The new change now passes `verificationUrlComplete` (likely containing `&` query params), so `cmd.exe` can split the command at `&`, truncating the URL or executing unintended trailing tokens. The URL should be quoted/escaped before passing to `cmd`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/tokscale-cli/src/auth.rs">

<violation number="1" location="crates/tokscale-cli/src/auth.rs:139">
P2: Windows URL escaping is incomplete: `%` is unescaped while invoking `cmd /C start`, so URLs can be mangled by environment-variable expansion.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/tokscale-cli/src/tui/data/mod.rs">

<violation number="1" location="crates/tokscale-cli/src/tui/data/mod.rs:1058">
P2: Regression tests were weakened from deterministic expected cost totals to broad sanity checks, reducing coverage for cost-parsing/aggregation regressions.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

2 issues found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/tokscale-cli/src/tui/data/mod.rs">

<violation number="1" location="crates/tokscale-cli/src/tui/data/mod.rs:577">
P2: Pricing-sensitive tests now bypass `DataLoader::load()` via a duplicated test helper, reducing coverage of production pricing initialization/fallback logic and risking test/production drift.</violation>
</file>

<file name="crates/tokscale-core/src/lib.rs">

<violation number="1" location="crates/tokscale-core/src/lib.rs:1227">
P2: `parse_local_unified_messages` now loads pricing before validating `home_dir`, causing avoidable network/cache I/O and delayed error reporting for invalid home-dir configurations.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}