Fix Xaman return across mobile browsers

[xrpbanks]

Summary

• keep the original CalorieApp browser tab open while Xaman completes in a separate tab/browser
• securely hand the authenticated session back with an expiring, one-time, hashed proof
• show clear launching and completion pages instead of unexpectedly landing on the homepage
• handle Render cold starts and HTTP 429 responses with Retry-After-aware polling/backoff

Verification

• 210 backend tests passed
• frontend lint passed
• frontend production build passed
• branch diff verified: exactly 12 intended files; no WordPress draft/plugin or release-check.ps1 changes

Do not merge until all GitHub checks are green.

[Copilot]

Pull request overview

This PR updates the Xaman authentication flow so the original CalorieApp tab can remain open while authentication completes in a separate tab/browser, then securely “hands back” authentication to the original tab via a short-lived, one-time proof. It also adds dedicated “launching” and “complete” UX pages and introduces backend support for polling login completion (including replay protection).

Changes:

• Frontend: open Xaman sign-in in a separate tab/window, poll backend for completion, and show explicit launching/completion pages.
• Backend: add an origin-browser handoff token model + identity service helpers, plus a new /api/identity/login/status endpoint to claim the session once.
• Tests/docs: expand identity tests for the handoff behavior and document the cross-browser return flow.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents the new cross-browser/tab Xaman return + handoff design.
frontend/components/XamanLoginPanel.tsx	Opens a separate sign-in tab, polls /api/identity/login/status, and displays success messaging.
frontend/app/auth/launching/page.tsx	Adds a dedicated “preparing sign-in” page for the new tab.
frontend/app/auth/complete/page.tsx	Adds a completion/confirmation page with safe local redirect handling.
frontend/app/auth/callback/page.tsx	Redirects callback to /auth/complete and sets a sessionStorage flag for messaging.
frontend/app/api/backend/[...path]/route.ts	Allow-lists the new backend route api/identity/login/status through the proxy.
backend/tests/test_identity.py	Adds service-level tests for origin handoff token hashing, status transitions, and cleanup.
backend/tests/test_identity_endpoints.py	Adds endpoint tests for cross-browser completion and replay/claim behavior.
backend/app/services/identity.py	Implements origin login handoff creation/validation/claiming helpers.
backend/app/schemas.py	Adds request/response schemas for login status polling and start response token.
backend/app/models.py	Adds OriginLoginHandoffDB table for one-time handoff proof state.
backend/app/main.py	Adds /api/identity/login/status, issues the handoff token on start, and completes/fails the handoff on callback.

Suppressed comments (1)

frontend/components/XamanLoginPanel.tsx:202

• loginWindow.opener = null can throw if the named window already exists and has navigated cross-origin (e.g., a previous login attempt left the external tab open). Wrap this assignment so a reusable cross-origin window doesn't cause the whole login flow to error.

      loginWindow.opener = null;

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.