efdaba606e
Like Claude Code's awsAuthRefresh: the user still approves each login. mode mac runs it on the Docker host over SSH (own browser); mode device shows the device code in pi for SSH/tmux use. Off by default (/aws-sso on). Session start inferred from refresh-token changes; 8 h default, measured.