- identity/: Quine OIDC provider (identity.quineglobal.com) built on
zitadel/oidc, with password and GitHub/Google (goth) sign-in, invite-only
accounts managed from the CLI, and persisted, hashed refresh tokens.
- server/: require Quine access tokens (verified with coreos/go-oidc) and
take the caller's username from the token.
- desktop/: RFC 8252 browser sign-in via the openidconnect crate with a
loopback redirect; refresh token kept out of the webview. UI rewritten in
Preact + htm (vendored, no build step), gating Quine -> meet.jit.si ->
dashboard.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>