Complete the post-checkout signup flow: Stripe checkout → container
starts → magic link generated → user clicks → logged into tenant
dashboard.
- Add pkg/cloudauth for shared HMAC-SHA256 handoff token sign/verify
- Add internal/cloudcp/auth for control plane magic link service with
SQLite-backed token store (standalone, no internal/api dependency)
- Add magic link verify handler on control plane that generates a
short-lived handoff token and redirects to tenant container
- Add /auth/cloud-handoff endpoint on tenant side that validates
handoff token and creates a session using existing auth machinery
- Expand provisioner to write per-tenant handoff key, poll container
health (2s interval, 60s timeout), and generate magic link on success
- Wire magic link service into control plane server and routes
