v0.5.9: El Torito boot detection + retroactive re-introspect; static SSO login button

Storage / boot detection
- Add El Torito boot-catalog detection to ISO introspection. This is the
  authoritative "can this boot at all?" signal: any ISO with a boot catalog
  (BSDs, ESXi, firmware tools, custom spins) is bootable via iPXE sanboot;
  a data/appliance ISO (e.g. a VMware vCenter bundle) has none and is
  honestly flagged. Replaces the crude ">1.5 GB ⇒ unbootable" size guess.
- Re-introspect stale LOCAL ISOs on startup via an introspection-revision
  gate (INTROSPECT_REV). ISOs uploaded by an older binary carried a frozen
  family/boot profile — most visibly a Windows 11 ISO tagged Unknown before
  the UDF/UTF-16 detection landed, which then showed "won't boot" forever.
  An upgrade now re-probes and fixes them in place; no delete-and-re-upload.
- WebUI bootability() keys off family / kernel / el_torito / remote-source
  instead of the size heuristic; dashboard family counts now bucket
  Windows / Linux / other honestly instead of lumping everything non-Windows
  under "Linux".

SSO login button
- The "Sign in with …" button keyed off the auth-gated /api/sso, which 401s
  pre-auth — so the button only survived on a stale in-memory config and
  vanished instance-wide on any fresh login-page load. Ship a minimal,
  non-sensitive SSO descriptor (enabled + idp_name + idp_logo_url, no
  metadata/entity-ID) on the public /api/me; the login card reads that.
  The button is now static whenever SSO is usable.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/core/src/lib.rs

@@ -36,4 +36,4 @@ pub use profile::DeployProfile;
 pub use queue::{DeploymentQueue, QueueEntry};
 pub use saml::{IdpMetadata, SamlError, SpParams, VerifiedPrincipal, VerifiedResponse};
 pub use settings::{Settings, SettingsStore, TimeoutAction};
-pub use sso::{SsoConfig, SsoStore};
+pub use sso::{SsoConfig, SsoLoginInfo, SsoStore};

crates/core/src/sso.rs

@@ -73,6 +73,23 @@ impl SsoConfig {
     }
 }
 
+/// The minimal, non-sensitive slice of the SSO config that the **pre-auth**
+/// login screen needs to render the "Sign in with …" button. Carries only
+/// the display affordances — never the metadata XML/URL or entity ID, which
+/// stay behind the auth-gated `/api/sso`. Served as part of the public
+/// `/api/me` so the button renders reliably whether or not anyone is signed
+/// in (v0.5.9: fixes the button vanishing because `/api/sso` 401s pre-auth).
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct SsoLoginInfo {
+    /// True only when SSO is *usable* (enabled AND a metadata source is
+    /// present) — i.e. clicking the button will actually reach an IdP.
+    pub enabled: bool,
+    /// Button label, e.g. "STC AD". Empty falls back to "SSO" in the UI.
+    pub idp_name: String,
+    /// Optional IdP logo rendered on the button. Empty = no image.
+    pub idp_logo_url: String,
+}
+
 /// In-memory + on-disk SSO settings registry.
 #[derive(Debug, Clone)]
 pub struct SsoStore {
@@ -111,6 +128,19 @@ impl SsoStore {
         self.inner.read().clone()
     }
 
+    /// Public, non-sensitive descriptor for the login screen. Safe to
+    /// expose pre-auth — it's exactly what the "Sign in with …" button
+    /// keys off, with no metadata/entity-ID leakage. v0.5.9.
+    #[must_use]
+    pub fn login_info(&self) -> SsoLoginInfo {
+        let cfg = self.inner.read();
+        SsoLoginInfo {
+            enabled: cfg.is_usable(),
+            idp_name: cfg.idp_name.clone(),
+            idp_logo_url: cfg.idp_logo_url.clone(),
+        }
+    }
+
     /// Replace the whole config in one shot. Light validation: metadata
     /// XML and URL are length-capped so an operator can't OOM us by
     /// pasting a 10 GiB blob; the IdP UI tab clamps the input visually,