feat: Implement magic link authentication

This commit introduces a new magic link authentication flow.
The desktop client can now request a temporary, one-time-use token from
the server.
This token is then used to open a URL in the system browser, which
redirects to the server.
The server consumes the token, installs a regular web session, and
redirects the user

server/src/magic_link.rs

@@ -0,0 +1,27 @@
+//! Short-lived, one-time tokens that turn a desktop API-key auth into a
+//! browser session without an interactive password login.
+//!
+//! Lifecycle: the desktop client calls `POST /api/auth/magic-link` (API-key
+//! authenticated), gets a token, opens the browser at `/web/magic?token=…`.
+//! The web handler removes the token (one-time-use) and installs a regular
+//! `WebSession`. TTL is intentionally short — the token only needs to
+//! survive the click → browser-launch → first-request round trip.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::Instant;
+
+use tokio::sync::RwLock;
+
+pub struct PendingMagicLink {
+    pub slug: String,
+    pub role: String,
+    pub return_to: String,
+    pub expires_at: Instant,
+}
+
+pub type MagicLinkStore = Arc<RwLock<HashMap<String, PendingMagicLink>>>;
+
+pub fn new_store() -> MagicLinkStore {
+    Arc::new(RwLock::new(HashMap::new()))
+}