fix: forward the pre-auth token on magic link verify and serve the confirm route

[Bccorb]

Adapter support for the magic link verification change in seamless-auth-api 0.19.0.

Changes

• GET /magic-link/verify/{token} forwards the requesting device's pre-auth token when one is available: the client's bearer token in bearer transport, or the pre-auth cookie's token in cookie transport, only when the cookie verifies. Without one it sends no Authorization and does not answer 401; the auth API then falls back to the client IP and user agent forwarded with the service token.
• This is special-cased by method and path. No new credential name is added to the known set, because older releases refuse a manifest that uses one.
• src/seamless_auth/manifest.json synced from the seamless-auth-api fix branch with scripts/sync-manifest.sh <path> (a local copy of its adapter-manifest.json, since the fix is not on the API's public main yet). It adds POST /magic-link/verify/{token}/confirm (credential none). The synced file says apiVersion: 0.18.0; the API stamps the version at release, so a re-sync from the API's main after 0.19.0 ships will only change that field.
• 409 confirmation_required bodies already pass through verbatim; a test now pins that requestedFrom survives.
• A GET /magic-link/check answering { "message": "Success" } with no tokens sets no cookies (test added; no code change needed).
• README: new "Magic links" section.

Files

• src/seamless_auth/_adapter.py
• tests/test_magic_link.py (new)
• src/seamless_auth/manifest.json
• README.md

Checks

This private fork runs no Actions, so the local output is below.

$ uv run ruff check .
All checks passed!
$ uv run ruff format --check .
31 files already formatted
$ uv run mypy
Success: no issues found in 13 source files
$ uv run pytest
168 passed in 0.64s
$ uv run pytest -v tests/test_magic_link.py
tests/test_magic_link.py::test_verify_forwards_the_client_bearer PASSED  [ 11%]
tests/test_magic_link.py::test_verify_forwards_a_valid_pre_auth_cookie_as_bearer PASSED [ 22%]
tests/test_magic_link.py::test_verify_without_a_usable_pre_auth_sends_no_authorization[no cookie] PASSED [ 33%]
tests/test_magic_link.py::test_verify_without_a_usable_pre_auth_sends_no_authorization[altered cookie] PASSED [ 44%]
tests/test_magic_link.py::test_verify_without_a_usable_pre_auth_sends_no_authorization[wrong kind] PASSED [ 55%]
tests/test_magic_link.py::test_verify_without_a_usable_pre_auth_sends_no_authorization[bearer without token] PASSED [ 66%]
tests/test_magic_link.py::test_confirmation_required_passes_through PASSED [ 77%]
tests/test_magic_link.py::test_confirm_is_proxied_without_a_credential PASSED [ 88%]
tests/test_magic_link.py::test_a_check_without_tokens_sets_no_cookies PASSED [100%]
============================== 9 passed in 0.01s ===============================

Release order

Part of the v0.19 security release (fells-code/seamless-auth-api#385), reviewed in a private fork. Compatible with the current auth API: the forwarded pre-auth credential and the confirm route are only used by API 0.19.0.