feat: add login --manual to sign in without a password prompt

[ynezz]

hi, my clankers found this nice project during research, I liked it so decided to make you aware about the changes I've made for my use cases, so everyone can profit from that, but feel free to close it or implement it differently, happy to help with testing, cheers, Petr

---

prusactl login asks for the Prusa Account password on the terminal. An AI agent that drives prusactl cannot answer this prompt, and it must not see the password.

login --manual prints the Prusa Account authorize link on its own line. It opens a browser unless --no-open is given. Then it reads one line from stdin: the address that the browser shows after approval, or only its code= value. prusactl compares the state in this address with the state in the link. It exchanges the code for tokens with the same PKCE flow as the password login.

There is no loopback (127.0.0.1) variant. Prusa Account rejects this redirect for the Connect client with "Mismatching redirect URI". The code must come from the address bar.

If --manual is not given and there is no terminal, login now suggests --manual. Before, it failed at the password prompt.

Testing

• Unit tests with a mocked authorize and token server: a pasted address, a pasted query, a bare code, and a state mismatch.
• Live sign-in against the real Prusa Account. The session was saved, and later Connect calls worked with it.

[trevin-lee]

The mechanics check out: PKCE, the state check against the pasted URL, and ask() reading from a non-tty so an agent can drive it. Opening the system browser is the right default here, and --no-open covers headless.

I'm pushing three small things:

• README line 28 says "no browser involved", which is no longer true. Changing it to "no browser needed", since the password login still works without one.
• The prompt says "on one line of stdin". That's right for an agent and jargon for a person. Changing it to "paste it here and press Enter".
• A README note that this depends on Connect's auth-callback page not redeeming a code whose state it didn't issue. It worked for you, so that's how the page behaves today, but Prusa could change it and the failure would be confusing without the note.