Drafting remote auth linking.

frontend/auth/restricted/RestrictedApi.vue

@@ -1,5 +1,14 @@
 <template>
+  <!-- Remote auth completion mode -->
+  <RemoteAuthComplete
+    v-if="remoteAuthToken"
+    :token="remoteAuthToken"
+    @back="handleBack"
+    @completed="handleRemoteCompleted"
+  />
+  <!-- Normal restricted auth mode -->
   <RestrictedAuth
+    v-else
     :mode="authMode"
     @authenticated="handleAuthenticated"
     @back="handleBack"
@@ -7,8 +16,25 @@
 </template>
 
 <script setup>
-import { computed, onMounted } from 'vue'
+import { computed, onMounted, ref } from 'vue'
 import RestrictedAuth from '@/components/RestrictedAuth.vue'
+import RemoteAuthComplete from '@/components/RemoteAuthComplete.vue'
+
+// Check if this is a remote auth URL: /remote/{token} or /auth/remote/{token}
+const remoteAuthToken = ref(null)
+
+function extractRemoteToken() {
+  const path = window.location.pathname
+  const match = path.match(/\/(?:auth\/)?remote\/([^/]+)$/)
+  if (match) {
+    const token = match[1]
+    // Validate it looks like a passphrase (contains dots)
+    if (token.includes('.')) {
+      return token
+    }
+  }
+  return null
+}
 
 // Detect mode from URL hash fragment
 const authMode = computed(() => {
@@ -39,7 +65,15 @@ function handleBack() {
   })
 }
 
+function handleRemoteCompleted() {
+  // Remote auth completed - the other device is now logged in
+  // This device doesn't need to do anything special
+}
+
 onMounted(() => {
+  // Check for remote auth token in URL
+  remoteAuthToken.value = extractRemoteToken()
+
   postToParent({
     type: 'auth-ready'
   })