fix: show Browser SSH reauthentication links

[Loic-SM]

Reference: #591 — Browser SSH fails with Tailscale SSH action: "check"

Tailscale SSH sends its re-authentication URL as a pre-auth SSH banner when an ACL rule uses action: "check". Browser SSH previously ignored that banner, so the user could not complete re-authentication before the SSH handshake timed out.

Summary

• Surface pre-authentication SSH banners in Browser SSH.
• Show HTTP(S) reauthentication links in the connection overlay.
• Preserve Headplane tsconnect extensions across upstream syncs.

Verification

• pnpm exec vitest run --project unit tests/unit/routes/ssh/auth-banner.test.ts
• pnpm exec oxlint app/routes/ssh/auth-banner.ts tests/unit/routes/ssh/auth-banner.test.ts
• Docker Go/WASM build

[pullfrog]

ℹ️ No critical issues — one tooling nit inline.

Reviewed changes

• Surfaced pre-auth SSH banners in Browser SSH. cmd/hp_ssh/wasm_js.go now installs an ssh.ClientConfig.BannerCallback (via patches/tsconnect-auth-banner.patch) that writes the banner to the terminal and invokes a new onAuthBanner callback.
• Rendered the reauthentication link in the connection overlay. page.tsx extracts the URL with getAuthenticationURL (app/routes/ssh/auth-banner.ts) and shows the banner text plus an "Authenticate to continue" link until onConnected fires.
• Threaded the callback end to end. wasm_js.d.ts, ghostty.client.tsx, and ghostty.client.tsx's transport pass onAuthBanner into the WASM termConfig.
• Stabilised the Ghostty effect deps. onConnected and onAuthBanner are now useCallback-memoised, so the terminal is no longer torn down and recreated on parent re-renders.
• Added a unit test, changelog entry, and sync-tooling update. tests/unit/routes/ssh/auth-banner.test.ts covers extraction and rejection; CHANGELOG.md gains a #591 fix line; scripts/sync-tsconnect.sh applies the new patch.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

The delta since the prior pullfrog review is a single tooling change:

• Consolidated the termConfig patch hunks. patches/tsconnect-types.patch now folds the separate termType and onAuthBanner additions into one @@ -22,9 +33,12 @@ hunk, replacing the mis-numbered third hunk the earlier review flagged.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[Loic-SM]

Hey @tale , ready to review :)