#1193 No way to log in on a headless host or with an OIDC-only account — please allow an API key

Trying to log in from a headless server with an OIDC-created account (no password) appears to lock this kind of user out entirely. Details from digging through the source:

The browser flow can't complete from a remote machine. Login finishes only when a browser redirects back to http://localhost:PORT/callback on the same machine running the CLI (src/libswamp/auth/login.ts:223-249). With the browser on a laptop and the CLI on a remote host, the token never returns, and the state nonce (correctly) rejects any cross-machine attempt (callback_server.ts: "State mismatch — possible CSRF attack"). So there's no way to complete it by opening the URL elsewhere.

The displayed device code isn't wired up. A device_code is generated and shown (device_verification event, login.ts:242), but nothing polls it — the CLI only ever waits on the loopback callback (login.ts:246). Worth noting server-login already implements a real polling device flow (server_login.ts, pollDeviceToken), so the pattern exists.

The only fallback needs a password OIDC accounts don't have. The non-browser path is password-based signIn() (login.ts:268), and I found no CLI or UI way to set a password on an OIDC account.

A fix looks mostly built already. Stored credentials are already API keys under the hood (minted at /api/auth/api-key/create, sent as x-api-key), and SWAMP_API_KEY is already honored with precedence over auth.json (auth_repository.ts:57-69) — it's just ephemeral. Options that would fully unblock this:

• Add swamp auth login --api-key <key> that validates via whoami and saves to auth.json — essentially what swamp auth server-login --token already does. This is my preferred fix.
• Confirm the web UI can mint an API key for OIDC users (or expose it if not).
• Nice-to-haves: poll the device code (parity with server-login), and when the browser can't open, fail fast with a hint rather than hanging on the callback.

Environment: swamp 20260716.194319.0-sha.df9fc306, Linux headless.