Fix Log In button when Tailscale auth URL is missing

[dantraynor]

What

Fixes the NeedsLogin flow so the popup’s Log In button no longer silently no-ops when Tailchrome does not already have a usable cached login URL.

When the cached URL is missing or invalid, the extension now asks the native helper to request a fresh Tailscale login URL, then opens that URL when it arrives in status.

Why

Closes #75.

The screenshots show Tailchrome successfully rendering the login-required view, but clicking Log In does not open a browser tab. The issue was that the popup depended on a cached IPN-bus BrowseToURL; if Tailchrome entered NeedsLogin without that cached URL, the button could appear active while having nothing valid to open.

How

• Added a native login command that calls StartLoginInteractive() to request or resume an interactive Tailscale login flow.
• Surface ipnstate.Status.AuthURL as a fallback when no cached BrowseToURL is available.
• Store browseToURL from either BrowseToURL or AuthURL, so the popup can recover from older or partial status updates.
• Updated the background login handler to:
  • open an existing valid login URL immediately
  • request a fresh login URL when the current URL is missing or invalid
  • track a pending login request and open the returned URL when it arrives
  • avoid duplicate native login requests while waiting
  • clear pending state on success, invalid URL, login error, timeout, or a transition to Running
• Tightened login URL validation to explicit Tailscale login hosts: login.tailscale.com, controlplane.tailscale.com, and tailscale.com.
• Added a user-visible timeout toast if no login URL arrives after 30 seconds.

Test

• Install the built extension and helper fresh on Chrome.
• Open Tailchrome in a state that shows Log in to Tailscale.
• Click Log In when a valid cached login URL is already present — a Tailscale login tab should open immediately.
• Click Log In when no cached login URL is present — Tailchrome should request a fresh URL from the native helper and open it when returned.
• Click Log In repeatedly while waiting — only one native login request should be sent, and the popup should show that it is still waiting.
• If no URL is returned after 30 seconds, the popup should show a timeout toast and allow retry.
• Confirm arbitrary non-login URLs are not opened.

Checklist

• go test ./...
• pnpm --filter @tailchrome/shared exec vitest run src/background/background.test.ts src/background/state-store.test.ts
• pnpm --filter @tailchrome/shared exec tsc --noEmit
• pnpm e2e --suite=full --grep="login requests fresh URL"
• Manual Chrome smoke test
• Manual Windows helper smoke test
• Update issue after release is available

Marking draft while I finish manual smoke testing.