feat(auth): headless login URL + import-codex + TUI

AGENTS.md

@@ -1,16 +1,17 @@
 # AGENTS.md — BYOKEY (Rust AI API proxy gateway)
 
 ## Architecture
-Layered DAG in `crates/`: `types`(L0) → `config`,`store`(L1) → `auth`,`translate`(L2) → `provider`,`proto`(L3) → `proxy`(L4). `daemon` sits outside the DAG and is consumed only by the CLI binary (`src/main.rs`, bin=`byokey`).
+Layered DAG in `crates/`: `types`(L0) → `config`,`store`(L1) → `auth`,`translate`(L2) → `provider`,`proto`(L3) → `proxy`(L4). `daemon` sits outside the DAG and is consumed only by the CLI binary (`src/main.rs`, bin=`byokey`). `tui` is an upper-layer management client used by the CLI binary; it talks to BYOKEY through the ConnectRPC management API rather than linking to server internals.
 - **types** — core traits (`TokenStore`, `UsageStore`, `ProviderExecutor`, `RequestTranslator`, `ResponseTranslator`), `ByokError`, `OAuthToken`, `ProviderId`
 - **store** — SQLite token/usage persistence via `sea-orm v2` + `sea-orm-migration`; `InMemoryTokenStore` for tests
 - **auth** — per-provider OAuth flows + `AuthManager` (token lifecycle, 30s refresh cooldown, background refresh loop: 60s interval / 5min lead)
 - **translate** — pure OpenAI↔Claude↔Gemini format conversion (no auth dependency)
 - **provider** — executor impls per provider + model registry + `CredentialRouter` (round-robin) + `VersionStore` (runtime-fetched UA/fingerprint strings from `assets.byokey.io/versions/{provider}.json`)
-- **proto** — ConnectRPC service definitions generated from `crates/proto/proto/*.proto` via `connectrpc-build` + `buffa`. Owns the management API schema: `byokey.status.StatusService`, `byokey.accounts.AccountsService`, `byokey.amp.AmpService`. Build-time dep on `protoc`. Isolated from the workspace `unsafe_code = "forbid"` lint because buffa's generated code uses `unsafe impl` for marker traits.
+- **proto** — ConnectRPC service definitions generated from `crates/proto/proto/*.proto` via `connectrpc-build` + `buffa`. Owns the management API schema: `byokey.status.StatusService`, `byokey.accounts.AccountsService`, `byokey.amp.AmpService`, plus the optional protocol-only `client` feature for shared management API clients. Build-time dep on `protoc`. Isolated from the workspace `unsafe_code = "forbid"` lint because buffa's generated code uses `unsafe impl` for marker traits.
 - **proxy** — axum HTTP server, SSE streaming, **single listener** on `:8018`. Serves three kinds of traffic from one port: REST AI proxy (`/v1/chat/completions` etc.), amp CLI compatibility (`/api/provider/*`, amp redirects, ampcode.com proxy), and ConnectRPC management as the fallback service (`/byokey.status.StatusService/{Method}`, `/byokey.accounts.AccountsService/{Method}`, `/byokey.amp.AmpService/{Method}`). The amp sub-router is wrapped in `forward_headers_middleware` scoped via `.layer()` before `.merge()`.
+- **tui** — ratatui management UI. Depends on `byokey-proto` with the `client` feature and renders snapshots from `StatusService` / `AccountsService`; it must not depend on `byokey-daemon`, `byokey-auth`, or `byokey-store`, and must not read SQLite directly.
 - **daemon** — PID/process management, Unix control socket (`~/.byokey/control.sock`, tarpc), OS service registration (launchd/systemd/Windows SCM); not in the DAG, only used by the CLI binary
-- **Key constraint:** `translate` must NOT depend on `auth`; `auth` must NOT depend on `translate` or `provider`; `types` has zero workspace deps; `proto` owns only protobuf-generated types (no business logic).
+- **Key constraint:** `translate` must NOT depend on `auth`; `auth` must NOT depend on `translate` or `provider`; `types` has zero workspace deps; `proto` owns protobuf-generated types and protocol-only client glue (no business logic); upper-layer apps such as `tui` use `proto`/ConnectRPC instead of bypassing `proxy` into `auth`, `store`, or `daemon`.
 
 ## Code Style
 - `unsafe_code = "forbid"`, `clippy::pedantic = "warn"`, edition 2024, async traits via `async-trait` macro (ConnectRPC handlers use plain `async fn`)

Cargo.toml

@@ -11,6 +11,7 @@ members = [
     "crates/proto",
     "crates/proxy",
     "crates/ampcode",
+    "crates/tui",
 ]
 exclude = ["desktop/src-tauri"]
 
@@ -37,6 +38,7 @@ byokey-provider = { version = "1.2.0", path = "crates/provider" }
 byokey-proto = { version = "1.2.0", path = "crates/proto" }
 byokey-proxy = { version = "1.2.0", path = "crates/proxy" }
 byokey-daemon = { version = "1.2.0", path = "crates/daemon" }
+byokey-tui = { version = "1.2.0", path = "crates/tui" }
 ampcode = { version = "0.1.1", path = "crates/ampcode" }
 loadwise-core = "0.1.0"
 aigw = { version = "0.4.0", default-features = false, features = ["anthropic", "anthropic-claude-code", "openai", "openai-compat"] }
@@ -165,6 +167,7 @@ byokey-auth.workspace = true
 byokey-store.workspace = true
 byokey-types.workspace = true
 byokey-daemon.workspace = true
+byokey-tui.workspace = true
 axum.workspace = true
 clap.workspace = true
 clap_complete.workspace = true