v0.5.9: El Torito boot detection + retroactive re-introspect; static SSO login button

Storage / boot detection
- Add El Torito boot-catalog detection to ISO introspection. This is the
  authoritative "can this boot at all?" signal: any ISO with a boot catalog
  (BSDs, ESXi, firmware tools, custom spins) is bootable via iPXE sanboot;
  a data/appliance ISO (e.g. a VMware vCenter bundle) has none and is
  honestly flagged. Replaces the crude ">1.5 GB ⇒ unbootable" size guess.
- Re-introspect stale LOCAL ISOs on startup via an introspection-revision
  gate (INTROSPECT_REV). ISOs uploaded by an older binary carried a frozen
  family/boot profile — most visibly a Windows 11 ISO tagged Unknown before
  the UDF/UTF-16 detection landed, which then showed "won't boot" forever.
  An upgrade now re-probes and fixes them in place; no delete-and-re-upload.
- WebUI bootability() keys off family / kernel / el_torito / remote-source
  instead of the size heuristic; dashboard family counts now bucket
  Windows / Linux / other honestly instead of lumping everything non-Windows
  under "Linux".

SSO login button
- The "Sign in with …" button keyed off the auth-gated /api/sso, which 401s
  pre-auth — so the button only survived on a stale in-memory config and
  vanished instance-wide on any fresh login-page load. Ship a minimal,
  non-sensitive SSO descriptor (enabled + idp_name + idp_logo_url, no
  metadata/entity-ID) on the public /api/me; the login card reads that.
  The button is now static whenever SSO is usable.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/iso-store/src/store.rs

@@ -223,7 +223,8 @@ impl IsoStore {
                 continue;
             }
             if let Ok(text) = tokio::fs::read_to_string(&p).await {
-                if let Ok(meta) = serde_json::from_str::<IsoMeta>(&text) {
+                if let Ok(mut meta) = serde_json::from_str::<IsoMeta>(&text) {
+                    self.reintrospect_if_stale(&mut meta).await;
                     self.insert(meta);
                 }
             }
@@ -231,6 +232,46 @@ impl IsoStore {
         Ok(())
     }
 
+    /// v0.5.9: re-run introspection on a *local* ISO whose persisted report
+    /// predates the current logic. ISOs uploaded by an older binary carry a
+    /// stale family/boot profile — most visibly a Windows 11 ISO tagged
+    /// `Unknown` before the UDF/El-Torito detection landed, which then shows
+    /// as "won't boot" forever. Re-probing on startup fixes them in place,
+    /// no delete-and-re-upload. Bounded: only `Local` sources (we have the
+    /// bytes locally) below [`introspect::INTROSPECT_REV`], so it runs at
+    /// most once per ISO per upgrade. The probe reads up to ~64 MiB, so we
+    /// push it onto the blocking pool to keep the async runtime responsive.
+    async fn reintrospect_if_stale(&self, meta: &mut IsoMeta) {
+        if !matches!(meta.source, IsoSource::Local)
+            || meta.introspection.introspect_rev >= crate::introspect::INTROSPECT_REV
+        {
+            return;
+        }
+        let path = self.iso_path(&meta.id);
+        if !path.exists() {
+            return;
+        }
+        let Ok(fresh) = tokio::task::spawn_blocking(move || introspect(&path)).await else {
+            tracing::warn!(target: "openpxe::iso", id = %meta.id, "re-introspect task failed");
+            return;
+        };
+        let before = meta.introspection.family;
+        meta.introspection = fresh;
+        meta.boot_entries = generate_boot_entries(&meta.id, &meta.filename, &meta.introspection);
+        if let Err(e) = self.persist_meta(meta).await {
+            tracing::warn!(target: "openpxe::iso", id = %meta.id, "re-introspect persist: {e}");
+            return;
+        }
+        tracing::info!(
+            target: "openpxe::iso",
+            id = %meta.id,
+            from = ?before,
+            to = ?meta.introspection.family,
+            el_torito = meta.introspection.el_torito,
+            "re-introspected stale ISO metadata"
+        );
+    }
+
     fn insert(&self, meta: IsoMeta) {
         self.inner.write().isos.insert(meta.id.clone(), meta);
     }
@@ -687,13 +728,7 @@ mod tests {
             size_bytes: 0,
             sha256_hex: None,
             uploaded_at: OffsetDateTime::now_utc(),
-            introspection: IntrospectionReport {
-                family: DistroFamily::Unknown,
-                volume_label: None,
-                kernel_path: None,
-                initrd_paths: vec![],
-                has_boot_wim: false,
-            },
+            introspection: IntrospectionReport::default(),
             boot_entries: vec![],
             source: IsoSource::Local,
             password_hash: None,