feat(ios): run verification and OAuth through ASWebAuthenticationSession

The captcha/OAuth flow relied on the OS routing the spotiflac://
callback back into the app. In sideload containers (LiveContainer)
the guest app's URL scheme is never registered with iOS, so after
solving the challenge the redirect went nowhere and the user could
not return to the app (LiveContainer#242/#162 — unresolved upstream).

ASWebAuthenticationSession intercepts the callback scheme in-process,
so no OS-level scheme registration is involved: the session sheet
closes itself on completion and the callback URL is fed into the same
deep-link handler the OS path uses. Verification challenges, the help
dialog's open-browser action, and extension OAuth logins all prefer
the session on iOS, falling back to url_launcher if it fails to start.
Safari's cookie store is shared so captcha providers see an
established browsing context.

lib/screens/settings/extension_detail_page.dart

@@ -7,8 +7,8 @@ import 'package:spotiflac_android/providers/extension_provider.dart';
 import 'package:spotiflac_android/providers/store_provider.dart';
 import 'package:spotiflac_android/services/platform_bridge.dart';
 import 'package:spotiflac_android/utils/app_bar_layout.dart';
+import 'package:spotiflac_android/utils/extension_auth_launcher.dart';
 import 'package:spotiflac_android/widgets/settings_group.dart';
-import 'package:url_launcher/url_launcher.dart';
 
 class ExtensionDetailPage extends ConsumerStatefulWidget {
   final String extensionId;
@@ -1164,9 +1164,9 @@ class _SettingItemState extends State<_SettingItem> {
           final openAuth = payload['open_auth_url'] as String?;
           if (openAuth != null && openAuth.isNotEmpty) {
             final uri = Uri.parse(openAuth);
-            final launched = await launchUrl(
+            final launched = await launchExtensionAuthUrl(
               uri,
-              mode: LaunchMode.externalApplication,
+              browserMode: 'external_first',
             );
             if (!launched && context.mounted) {
               ScaffoldMessenger.of(context).showSnackBar(

lib/services/platform_bridge.dart

@@ -547,6 +547,23 @@ class PlatformBridge {
     await _channel.invokeMethod('resetDownloadCancel', {'item_id': itemId});
   }
 
+  /// iOS only: run a verification/OAuth page inside ASWebAuthenticationSession.
+  /// The session intercepts the callback scheme in-process, so the flow
+  /// completes even where the app's URL scheme is not registered with the OS
+  /// (e.g. sideload containers like LiveContainer). Returns true when the
+  /// session was presented; the callback is delivered through the native side
+  /// exactly like an OS deep link.
+  static Future<bool> startIosWebAuthSession(
+    String url, {
+    String callbackScheme = 'spotiflac',
+  }) async {
+    final result = await _channel.invokeMethod('startWebAuthSession', {
+      'url': url,
+      'callback_scheme': callbackScheme,
+    });
+    return result == true;
+  }
+
   static Future<void> setDownloadDirectory(String path) async {
     await _channel.invokeMethod('setDownloadDirectory', {'path': path});
   }

lib/utils/extension_auth_launcher.dart

@@ -1,4 +1,5 @@
 import 'dart:async';
+import 'dart:io' show Platform;
 
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
@@ -299,7 +300,27 @@ String? _firstRegexGroup(String input, RegExp regex) {
   return match?.group(1);
 }
 
+/// Opens an extension auth/verification page. On iOS this prefers an
+/// ASWebAuthenticationSession, which captures the spotiflac:// callback
+/// in-process — required for environments where the app's URL scheme is not
+/// registered with the OS (sideload containers like LiveContainer) and nicer
+/// everywhere else (the sheet closes itself once the challenge completes).
+Future<bool> launchExtensionAuthUrl(Uri uri, {required String browserMode}) {
+  return _launchVerificationUrl(uri, browserMode);
+}
+
 Future<bool> _launchVerificationUrl(Uri uri, String browserMode) async {
+  if (Platform.isIOS && uri.scheme == 'https') {
+    try {
+      if (await PlatformBridge.startIosWebAuthSession(uri.toString())) {
+        return true;
+      }
+      _log.w('Web auth session did not start, falling back to browser');
+    } catch (e) {
+      _log.w('Web auth session failed, falling back to browser: $e');
+    }
+  }
+
   final preferInApp = browserMode.trim().toLowerCase() == 'in_app_first';
   final firstMode = preferInApp
       ? LaunchMode.inAppBrowserView