Add silent auto-login via prompt=none OAuth check

Middleware on every GET checks if user is logged in. If not, does a
silent prompt=none redirect to account. If account has an active
session, login completes invisibly. Otherwise sets a 5-minute cooldown
cookie to avoid redirect loops.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/__init__.py

@@ -4,15 +4,23 @@ Art-DAG L1 Server Application Factory.
 Creates and configures the FastAPI application with all routers and middleware.
 """
 
+import time
 from pathlib import Path
+from urllib.parse import quote
+
 from fastapi import FastAPI, Request
-from fastapi.responses import JSONResponse
+from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi.staticfiles import StaticFiles
 
 from artdag_common import create_jinja_env
+from artdag_common.middleware.auth import get_user_from_cookie
 
 from .config import settings
 
+# Paths that should never trigger a silent auth check
+_SKIP_PREFIXES = ("/auth/", "/static/", "/api/", "/ipfs/", "/download/")
+_SILENT_CHECK_COOLDOWN = 300  # 5 minutes
+
 
 def create_app() -> FastAPI:
     """
@@ -38,6 +46,37 @@ def create_app() -> FastAPI:
     async def shutdown():
         await close_db()
 
+    # Silent auth check — auto-login via prompt=none OAuth
+    @app.middleware("http")
+    async def silent_auth_check(request: Request, call_next):
+        path = request.url.path
+        if (
+            request.method != "GET"
+            or any(path.startswith(p) for p in _SKIP_PREFIXES)
+            or request.headers.get("hx-request")  # skip HTMX
+        ):
+            return await call_next(request)
+
+        # Already logged in
+        if get_user_from_cookie(request):
+            return await call_next(request)
+
+        # Check cooldown — don't re-check within 5 minutes
+        pnone_at = request.cookies.get("pnone_at")
+        if pnone_at:
+            try:
+                if (time.time() - float(pnone_at)) < _SILENT_CHECK_COOLDOWN:
+                    return await call_next(request)
+            except (ValueError, TypeError):
+                pass
+
+        # Redirect to silent OAuth check
+        current_url = str(request.url)
+        return RedirectResponse(
+            url=f"/auth/login?prompt=none&next={quote(current_url, safe='')}",
+            status_code=302,
+        )
+
     # Initialize Jinja2 templates
     template_dir = Path(__file__).parent / "templates"
     app.state.templates = create_jinja_env(template_dir)