Native accounts and browser return

User direction, 2026-09-13: all Oficina apps use the Eleven account model. Open the most recent account; Back returns to saved accounts; adding an account keeps existing sessions. Explicit Sign out revokes only the selected native session. Store opaque credentials in per-app Keychain entries keyed by account UUID; UserDefaults stores only display names, server origins and the most recent ID. Migrate the existing origin-keyed credential only after its new entry is saved. Account switches recreate workspace models so content cannot cross accounts.

Use ASWebAuthenticationSession for system browser authentication and normal browser session sharing, allowing existing Home sessions when the server enables Home. Each app registers works.oficina.<app> as its custom URL scheme. The server accepts only the exact callback for its app; after explicit browser approval it returns a random request ID, never a credential. Only the originating app's verifier can exchange approval for a session. Reject foreign/stale callbacks. Old servers may ignore callbacks; in-app polling still dismisses the authentication session after a successful proof exchange. Cancellation invalidates pending work.

Sheets library: shape-only native thumbnail rows; top-right More menu for Import, appearance and Sign out; native bottom search and New toolbar; Accounts back button is disabled while edits or writes need completion. Editor-to-library Back keeps the editor model alive, preserving existing draft protection.

Meet retains its existing meeting/invitation-bound Go sign-in protocol. Its verified result is adopted through NativeConnection.rememberSession, which validates the canonical origin and cookie format before saving. Its browser uses the same system authentication presenter. Saved account sessions are reused only for meeting links on the same origin; invitation redirects are resolved without forwarding cookies to another origin. Adding another Meet account starts a new explicit browser proof.