fix(auth): use a fresh mux and server per interactive auth attempt

[fabienfleureau]

📝 What

• Interactive qovery auth now builds its own http.ServeMux and http.Server per attempt instead of registering on http.DefaultServeMux.
• The callback listener is opened before the browser, and a busy callback port is reported instead of silently ignored.
• A rejected or stale authorization code (non-200, bad JSON or empty access token) prints the auth error, stores nothing and exits with status 1 instead of saving blank tokens and printing "Success!".
• The browser page shows success only after the token exchange succeeded, and shows a failure message otherwise.
• A callback without a code also prints the auth error and exits with status 1, only after the failure response is fully sent to the browser; a repeated callback after a success is answered with the first success and never replays the code.
• Headless and interactive flows share one token persistence path.

🎯 Why: a second attempt in one process (re-auth after a 401) panicked on the duplicate /authorization pattern.
✅ Verified: Unit tests (incl. race detector), vet and build green; rejected exchanges store nothing and show a failure in the browser. golangci-lint not run locally (toolchain mismatch), left to CI.

🧪 How to test

# Needs a build of this branch and a session whose access token is expired/invalid
qovery auth
# expect browser opens, "Success!" printed, command returns
qovery auth   # run again in a second shell while the first waits
# expect "can not listen on localhost:10999 ..." error and exit code 1, no panic

---

Summary by cubic

Fixes interactive qovery auth so re-authenticating after a 401 no longer panics on duplicate /authorization handlers, and a rejected or stale authorization code can't be stored or reported as a successful login.

• Uses a fresh http.ServeMux, http.Server, and PKCE verifier per attempt, so repeat attempts in one process don't collide.
• Binds the callback port before the browser opens and reports a busy port instead of ignoring it; the port is released after the callback.
• Prints the error and exits 1 when the exchange fails (non-200, invalid or trailing JSON, empty access token) or the callback code is missing; nothing is stored.
• Makes the callback one-shot so a repeated callback never replays the consumed code.
• Shows the browser success page only after the exchange succeeds, and exits only once the failure response is confirmed delivered to the browser (no fixed delay, and no exit at all if delivery can't be confirmed, including a missing tracked connection).
• Avoids a window.status clash in the callback page script and exercises it in node tests.

^{Written for commit c0fb5cb. Summary will update on new commits.}

[Copilot]

🟡 Changes recommended

A stale browser launch still runs before binding and causes two tabs to open.

1 open finding

• Open auth URL only after listener binds · New

What changed in this PR

Introduces isolated callback servers for repeatable interactive authentication.

Changes:

• Uses a per-attempt HTTP mux and server.
• Binds the callback listener before the intended browser launch.
• Adds tests for repeated attempts, PKCE isolation, and port release.

File	Description
pkg/​auth_service.go	Refactors interactive authentication server lifecycle.
pkg/​auth_service_test.go	Tests callback-server isolation and reuse.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/testdata/auth_page_harness.js">

<violation number="1" location="pkg/testdata/auth_page_harness.js:112">
P3: The `success` and `http-error` branches are now byte-identical: both take status and body from the same env vars and call `onload()`. Merge them into one branch so a future scenario difference can't silently apply to or be missed in one of the two.</violation>
</file>