Feature: Add admin-only SSO bridge to web UI

Bridge an already-authenticated portal session into a YAMA web session via
a new /sso endpoint, so portal administrators can enter the remote-desktop
UI without a second login. Only the "admin" portal role is bridged; any
other role (viewer, unknown) still falls back to the built-in login form,
so a low-privileged portal account cannot bypass authentication.

- wsauth: extract IssueToken from VerifyLogin so an out-of-band-authenticated
  identity (SSO) can mint a session token without the challenge/response.
- web: add the SSODetector interface, a fail-closed JWT detector (HMAC-only),
  and the /sso handler gated to the admin role.
- cmd: enable the JWT detector via YAMA_SSO_JWT_SECRET, the shared HS256
  secret matching the parent portal.
- web UI: attempt SSO before showing the login form, falling back to login
  when the server returns 401.
- docs: document SSO (admin-only) and license trial-vs-paid troubleshooting
  in README and the env example.

Co-Authored-By: deepseek-v4-pro

server/go/cmd/main.go

@@ -935,12 +935,26 @@ func main() {
 	if basePath != "" {
 		log.Info("Serving web UI under base path %q (subpath deployment)", basePath)
 	}
+	// SSO: an optional detector bridges an already-authenticated portal
+	// session into a YAMA web session via /sso — but only for portal
+	// administrators. Any other portal role (viewer, unknown) still has to
+	// authenticate against YAMA's own login form. The built-in JWT detector is
+	// enabled by YAMA_SSO_JWT_SECRET (the shared HS256 secret); a different
+	// portal can plug in its own web.SSODetector by assigning webCfg.SSO.
+	var ssoDetector web.SSODetector
+	if secret := os.Getenv("YAMA_SSO_JWT_SECRET"); secret != "" {
+		ssoDetector = web.NewJWTDetector(web.JWTDetectorConfig{Secret: secret})
+		log.Info("SSO enabled: bridging portal admins into web sessions via /sso")
+	} else {
+		log.Info("SSO disabled (YAMA_SSO_JWT_SECRET not set) — web login only")
+	}
 	webCfg := web.Config{
 		AllowedOrigins:    allowedOrigins,
 		LoginIPLimit:      wsauth.NewRateLimiter(10, time.Minute),
 		LoginUserLimit:    wsauth.NewRateLimiter(5, 15*time.Minute),
 		TrustForwardedFor: trustProxy,
 		BasePath:          basePath,
+		SSO:               ssoDetector,
 	}
 
 	// Start HTTP server for web UI. Hub gives it read-only access to the