Installer-facing contract: login progress display, auth status --check, backend connect confirmation

[LukasWodka]

Part of the installer first-run UX v2 spec (umbrella in the backend tracker; interim copy fixes in tracebloc/client#307). The installer shells out to the CLI for sign-in, session state, and connect verification — these three output/contract changes make the approved installer copy renderable and honest.

1. login — progress display

Today the device-flow wait is a static hint with no motion. Target output (glyphs already match the installer's ✔/·/⚠ vocabulary):

   Open    https://ai.tracebloc.io/activate
   Enter   WDJB-MJHT

⠴ Waiting for your browser… 0:41   (Ctrl-C to cancel)
✔ Signed in as lukas@tracebloc.io

• Field labels open:/code: → Open/Enter.
• Live spinner + mm:ss elapsed during the RFC 8628 poll loop (first \r-redraw in internal/ui — keep it TTY-gated, static line under --plain/no-TTY).
• Demote "Token saved to ~/.tracebloc (0600)." to a dim detail line.

2. auth status --check — machine-readable session probe

auth status exits 0 in BOTH signed-in and signed-out states (verified on v0.5.1 and develop), so scripts must grep prose today. Add --check: exit 0 = token present and accepted by the backend (WhoAmI probe), exit 1 = sign-in needed. Silent by default. The installer's "session probe" step becomes a one-liner and ✔ Already signed in as … on re-runs stops being a text-parse.

3. Connect confirmation — honest "🟢 Online"

The installer's final claim today is fed only by kubectl rollout status — nothing ever asks the backend whether it can see the client (RFC-0001 §8.5 explicitly requires the Online claim to reflect a real probe). The backend status already flows through client list (online/offline/pending). Add a wait mode, e.g.:

tracebloc client status --wait --timeout 120s   # exit 0 when the backend reports this client online

polling the same source client list renders. Powers the installer's closing sequence:

⠸ Waiting for tracebloc to confirm… 0:12
✔ tracebloc can see this client

Acceptance

• login on a TTY shows spinner+elapsed; --plain/piped output stays static (no raw ANSI).
• auth status --check exit codes: 0 signed-in-valid / 1 signed-out or rejected token; no output unless -v.
• client status --wait exits 0 only on backend-reported online; non-zero on timeout with a plain-language line.

Refs: RFC-0001 (cli#55) §8.1/§8.5 · connect/install flow family backend#877.

🤖 Generated with Claude Code

[LukasWodka]

Umbrella spec: tracebloc/backend#992 (installer first-run UX v2). Sibling: #137. Interim installer copy: tracebloc/client#307.