v0.1.1: monochrome UI, spaced settings tabs, keychain-safe publishing

The accent is ink rather than blue: primary buttons, the floating Add
button, the empty-state shield, the active settings tab, the switch, the
countdown ring and the initials tile. Light mode uses a deep near-black
with a whisper of cool hue, dark mode a near-white — the Daito / Beautiful
UI treatment. Status colours and the platform dots keep their hue because
they carry meaning. The input focus glow stays, now a neutral 4px halo
with a mid-grey edge.

The per-issuer hue helper in the web UI is gone; the rendered chat tile
still uses its issuer colour, where it helps tell accounts apart.

Settings tabs get an 8px gap: each pill carries a 1px hairline ring
outside its box, so 4px read as the pills touching.

build-and-publish-unraid.sh writes registry auth into its private Docker
config instead of `docker login`/`docker logout`. With an empty config
the CLI falls back to docker-credential-osxkeychain, which shares its
keychain item with git's helper: login fails with -25299 and logout
deletes the credential git uses. PUBLISHING.md documents the trap and the
release flow for this version.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

scripts/build-and-publish-unraid.sh

@@ -13,9 +13,9 @@
 #   GITEA_OWNER   default: mward4
 #   GITEA_REPO    default: OpenMFA
 #   IMAGE_NAME    default: openmfa
-#   IMAGE_TAG     default: 0.1.0   (also pushed as :latest)
+#   IMAGE_TAG     default: 0.1.1   (also pushed as :latest)
 #   PLATFORM      default: linux/amd64  (Unraid is x86_64)
-#   GIT_REF       default: v0.1    (tag/branch to build)
+#   GIT_REF       default: v0.1.1  (tag/branch to build)
 #   WORKDIR       default: /tmp/openmfa-build (removed on exit)
 #
 # After this, set the Unraid template's Repository to:
@@ -27,9 +27,9 @@ GITEA_HOST=${GITEA_HOST:-gitea.milesward.dev}
 GITEA_OWNER=${GITEA_OWNER:-mward4}
 GITEA_REPO=${GITEA_REPO:-OpenMFA}
 IMAGE_NAME=${IMAGE_NAME:-openmfa}
-IMAGE_TAG=${IMAGE_TAG:-0.1.0}
+IMAGE_TAG=${IMAGE_TAG:-0.1.1}
 PLATFORM=${PLATFORM:-linux/amd64}
-GIT_REF=${GIT_REF:-v0.1}
+GIT_REF=${GIT_REF:-v0.1.1}
 WORKDIR=${WORKDIR:-/tmp/openmfa-build}
 
 # OCI distribution rejects uppercase repository paths, so the image name is
@@ -51,10 +51,23 @@ done
 
 # A private docker config so the token never lands in ~/.docker/config.json.
 # The trap wipes it (and the checkout) on any exit path.
+#
+# The auth is written into the file directly rather than via `docker login`.
+# With an empty config the CLI falls back to the platform credential helper,
+# and on macOS `docker-credential-osxkeychain` shares its keychain item with
+# git's `osxkeychain` helper: `login` then fails with -25299 if git already
+# stored the token, and `logout` deletes the credential git was using. A
+# config that already contains an `auths` entry skips the helper entirely.
 DOCKER_CONFIG="$(mktemp -d)"
 export DOCKER_CONFIG
 trap 'rm -rf "$DOCKER_CONFIG" "$WORKDIR"' EXIT
 
+# Colima keeps its socket outside /var/run; an isolated DOCKER_CONFIG has no
+# `currentContext`, so point at the daemon explicitly when one is not set.
+if [[ -z "${DOCKER_HOST:-}" && -S "$HOME/.colima/default/docker.sock" ]]; then
+  export DOCKER_HOST="unix://$HOME/.colima/default/docker.sock"
+fi
+
 echo
 echo "==> Workspace     : $WORKDIR"
 echo "==> Gitea host    : $GITEA_HOST"
@@ -84,18 +97,15 @@ docker build \
     --tag "$LATEST_TAG" \
     .
 
-# Step 3: log in. --password-stdin keeps the token out of `ps` and shell history.
-printf '%s' "$GITEA_TOKEN" | docker login \
-    --username "$GITEA_OWNER" \
-    --password-stdin \
-    "$GITEA_HOST"
+# Step 3: registry auth, written straight into the private config (see above).
+printf '{"auths":{"%s":{"auth":"%s"}}}' "$GITEA_HOST" \
+    "$(printf '%s:%s' "$GITEA_OWNER" "$GITEA_TOKEN" | base64 | tr -d '\n')" \
+    > "$DOCKER_CONFIG/config.json"
 
-# Step 4: push both tags.
+# Step 4: push both tags. The trap removes the config, so there is no logout.
 docker push "$FULL_TAG"
 docker push "$LATEST_TAG"
 
-docker logout "$GITEA_HOST" || true
-
 echo
 echo "==> Done. Pull from an Unraid template with:"
 echo "        $FULL_TAG"