Desktop span: hidden md:inline-flex, mobile span: block md:hidden.
Prevents both showing when fragment is injected in a single spot.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phase 2 of fragment composition: account exposes auth-menu fragment
(sign-in button or user email for desktop + mobile) via
/internal/fragments/ endpoint. Updates shared submodule.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Account creates OAuthGrant per authorization, revokes on logout.
Client apps verify grants via /auth/internal/verify-grant endpoint.
Removes iframe-based logout page.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Account is now the OAuth authorization server with magic link login,
OAuth2 authorize endpoint, SSO logout, and session management.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>