Feature: Add admin-only SSO bridge to web UI

Bridge an already-authenticated portal session into a YAMA web session via
a new /sso endpoint, so portal administrators can enter the remote-desktop
UI without a second login. Only the "admin" portal role is bridged; any
other role (viewer, unknown) still falls back to the built-in login form,
so a low-privileged portal account cannot bypass authentication.

- wsauth: extract IssueToken from VerifyLogin so an out-of-band-authenticated
  identity (SSO) can mint a session token without the challenge/response.
- web: add the SSODetector interface, a fail-closed JWT detector (HMAC-only),
  and the /sso handler gated to the admin role.
- cmd: enable the JWT detector via YAMA_SSO_JWT_SECRET, the shared HS256
  secret matching the parent portal.
- web UI: attempt SSO before showing the login form, falling back to login
  when the server returns 401.
- docs: document SSO (admin-only) and license trial-vs-paid troubleshooting
  in README and the env example.

Co-Authored-By: deepseek-v4-pro

server/go/deploy/yama-server.env.example

@@ -33,6 +33,15 @@ YAMA_WEB_TRUST_PROXY=1
 # WebSocket Origin 白名单（逗号分隔）。空 = 仅允许同源
 #YAMA_WEB_ALLOWED_ORIGINS=https://你的域名
 
+# ---------- SSO（单点登录，可选）----------
+
+# 共享的 HS256 签名密钥。设置后启用 SSO：YAMA 校验父域名（如 FMS 网关）下发的
+# auth_token JWT，通过后为门户管理员铸一枚 YAMA 会话、免二次登录。
+# 取值必须与上游门户的签名密钥一致（FMS 即 SERVER_PRIVATE_KEY）。
+# ⚠️ 仅 admin 角色的门户用户会被自动登录；其他角色（viewer / 未知）即使已登录
+#    门户，也必须再输一遍 YAMA 自己的 Web 登录密码（/sso 返回 401 → 回退登录页）。
+#YAMA_SSO_JWT_SECRET=
+
 # ---------- 授权 / 许可（signer）----------
 # 优先级：YAMA_SIGN_PASSWORD > YAMA_LICENSE_DISABLED=1 > YAMA_LICENSE_TOKEN > 匿名试用
 
@@ -48,6 +57,9 @@ YAMA_WEB_TRUST_PROXY=1
 # 客户 JWT（付费客户解锁设备配额）
 #YAMA_LICENSE_TOKEN=
 
+# ⚠️ EnvironmentFile 只在服务启动时读一次：改本文件后必须 systemctl restart <服务>，
+#    否则改动不生效（现象：启动日志仍是 "Signer mode: TRIAL" 而非 REMOTE）
+
 # 缓存 TTL（小时，RemoteSigner 离线缓存，默认 24）
 #YAMA_LICENSE_OFFLINE_HRS=24