feat: show the address in the Google sign-in window

[zebus3d]

What and why

The YouTube Music sign-in window is a bare webview, so users type their Google password without seeing where they are. A browser would show the address, and that is what lets people notice a lookalike phishing page.

The sign-in window now shows a read-only address bar above Google's page, like a browser:

• The window holds two webviews: the bar (login-bar.html, a tiny local page) on top and the Google page below it.
• The bar has no IPC access (it is not in any capability), and only Rust writes to it. On every page load of the sign-in webview, on_page_load calls eval("window.showUrl(...)") on the bar with the real URL, JSON-encoded. The page being shown cannot reach the bar, so it cannot fake it.
• The Google page keeps everything it had: its own storage partition per account slot, the macOS user agent and data store, and the loaded flag the silent refresh relies on.
• The callers now work with the page Webview and close its window, and cancelSignIn looks the window up with Window.getByLabel, since no webview carries the window's own label any more.

More than one webview per window needs Tauri's unstable feature. On Linux, Tauri packs child webviews into the window's GTK box, which ignores bounds and splits the height evenly, so there the bar is pinned to its own height through GTK. That adds the gtk crate, which is already in the dependency tree through Tauri. On other platforms the two webviews are laid out again on resize.

How it was checked

• npm run verify passes
• cargo test passes
• Ran the app on EndeavourOS, KDE Plasma 6.7.5: the bar shows https://accounts.google.com/…, follows navigation, and keeps its height when the window is resized.

Notes for the reviewer

• Not tested on Windows or macOS. I could only build and run it on Linux. The non-Linux path places the webviews with set_bounds on resize; please give it a quick look there before merging.
• This is the most invasive of my PRs (the unstable feature, a new page in vite.config.ts, a gtk dependency on Linux), so it is kept separate from the rest. Feel free to decline it if that trade-off is not worth it for you.
• URL changes a page makes with pushState, without a navigation, do not fire on_page_load. The host shown is still right in that case, which is the part that matters for spotting a phishing page.

[vercel]

@zebus3d is attempting to deploy a commit to the Faizan Asad's projects Team on Vercel.

A member of the Team first needs to authorize it.