Collect Android browser sign-ins after the app was stopped

The Android app kept a pending browser sign-in in a thread inside the
login screen. Android often kills the process while the browser is in
front, so the approval reached the server but nothing collected it, and
the app came back signed out with nothing saved.

The pending device code is now kept in Prefs and collected whenever the
login screen resumes. The app passes return_url=keeporg://device-approved
when it starts the sign-in, and the server's approval page, after a
password or single sign-on, links back to it. Only the keeporg: scheme is
accepted. Against a server older than 0.9, which rejects the field, the
app retries without it.

Verified on an Android 15 emulator: approval collected after the process
was killed, and the fallback against the 0.8 server.

Server 0.9.0, Android 0.3.0 (versionCode 3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/integration_test.go

@@ -452,3 +452,39 @@ func TestNonAdminCannotAdminister(t *testing.T) {
 		t.Fatalf("anonymous list: %d", status)
 	}
 }
+
+func TestDeviceApprovalLinksBackToTheApp(t *testing.T) {
+	h := newHarness(t)
+	if status, body := h.call("POST", "/api/v1/auth/device/start", "",
+		map[string]string{"label": "phone", "return_url": "https://evil.example/"}); status != http.StatusBadRequest {
+		t.Fatalf("foreign return_url accepted: %d %v", status, body)
+	}
+	status, start := h.call("POST", "/api/v1/auth/device/start", "",
+		map[string]string{"label": "phone", "return_url": "keeporg://device-approved"})
+	if status != http.StatusOK {
+		t.Fatalf("device start: %d %v", status, start)
+	}
+	resp, err := h.http.Client().PostForm(h.http.URL+"/device", url.Values{
+		"code": {start["user_code"].(string)}, "username": {"admin"}, "password": {adminPassword}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	page, _ := io.ReadAll(resp.Body)
+	resp.Body.Close()
+	if !strings.Contains(string(page), `href="keeporg://device-approved"`) {
+		t.Fatalf("approval page has no link back to the app: %s", page)
+	}
+
+	// A client that asked for nothing gets no link.
+	_, start = h.call("POST", "/api/v1/auth/device/start", "", map[string]string{"label": "laptop"})
+	resp, err = h.http.Client().PostForm(h.http.URL+"/device", url.Values{
+		"code": {start["user_code"].(string)}, "username": {"admin"}, "password": {adminPassword}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	page, _ = io.ReadAll(resp.Body)
+	resp.Body.Close()
+	if strings.Contains(string(page), "Return to KeepOrg") {
+		t.Fatalf("link shown without a return_url: %s", page)
+	}
+}