[BenA-SA]

Summary

Clicking Connect Garmin when TPV loads did nothing (#6). The same applies to Strava, TrainingPeaks, intervals.icu and the other account-linking buttons. TPV opens an OAuth page through xdg-open, and the container has no browser. The OAuth redirect goes to api.indievelo.com, not a local callback, so all that's needed is to open the page in a browser.

Stacked on #10 (host timezone). Base is fix/host-timezone; retarget to master once #10 merges.

Changes

• scripts/xdg-open-host.sh, installed as /usr/local/bin/xdg-open: forwards http(s)/mailto links to the host desktop through org.freedesktop.portal.OpenURI with gdbus. If there's no session bus or the portal refuses, it prints the link to open by hand. Other link types are refused.
• Containerfile.full: adds libglib2.0-bin (gdbus) and the symlink.
• run-tpv.sh: mounts the host session bus ($XDG_RUNTIME_DIR/bus → /run/host-session-bus) and sets DBUS_SESSION_BUS_ADDRESS. It warns if there's no session bus.
• README: session bus row in the podman flags table, the new file in the Files table, and the Scope note.
• ADR-0004: why the portal instead of a browser in the image or printing the URL; security trade-off of mounting the session bus.

Testing

• ⏳ Not yet verified in this PR: clicking Connect Garmin opening the host browser, linking completing, and the link persisting across container restarts. The laptop's running image predates this change.
• After merging: rebuild, click Connect Garmin. Expect ==> opened in host browser: https://... in the container output and the page in your browser. Then restart the container and check Garmin still shows as linked.
• The session-bus mount widens host coupling. See the ADR's cost section.

Closes #6

🤖 Generated with Claude Code

[BenA-SA]

Tested on top of master with #12 and #10 merged: tpv-full:pr11 built from 6a8bcd1, started with run-tpv.sh tpv.

• The container got the host session bus (DBUS_SESSION_BUS_ADDRESS=unix:path=/run/host-session-bus)
• Clicking Connect Garmin printed ==> opened in host browser: https://connect.garmin.com/oauth2Confirm, and the page opened in the host browser
• Garmin SSO finished in the browser. The redirect "back to TPV" is server-side: nothing came into the container, and TPV didn't change until the next start
• After a container restart, the link had persisted and TPV went straight to the main page

Note for the branch history: this branch was stacked on fix/host-timezone. After #10 was squash-merged, it was rebuilt as master plus this PR's own two commits and retargeted to master. The Containerfile.full conflict with #12 was resolved by putting libglib2.0-bin in the stable apt block, above the Mesa backports layer.