feat: install and launch Minecraft with NeoForge and Microsoft login

Wires up the actual game pipeline behind the existing ShaCraft manifest
sync: Mojang version resolution, Java 21 auto-provisioning via Adoptium,
headless NeoForge installation, real Microsoft/Xbox/Minecraft Services
login, and an offline account mode, then builds and spawns the java
process itself.

- mojang.rs: vanilla trust boundary, inheritsFrom version-JSON merge,
  asset/library downloading with a worker pool and per-file retries
- neoforge.rs: runs NeoForge's own installer headlessly, with live
  progress parsed from its output against its own install_profile.json
- runtime.rs / java.rs: detects a usable local Java or provisions one
  from Eclipse Temurin, with real download progress
- msa.rs: device-code OAuth -> Xbox Live -> XSTS -> Minecraft Services,
  gated on ShaCraft registering its own Azure AD app (see MSA_CLIENT_ID)
- session.rs / launch.rs: offline deterministic UUIDs and the merged
  java invocation itself
- download.rs: shared verified-download helper (temp file, hash,
  atomic rename, retries, progress) used across all of the above and
  refactored into profile.rs
- UI: account mode toggle (Microsoft/offline), login modal, and real
  per-stage install progress instead of start/done placeholders

docs/launcher-architecture.md

@@ -2,22 +2,43 @@
 
 ## Current capability
 
-The launcher can persist local settings, discover an installed Java runtime,
-inspect a profile and synchronise Aeronautics files from the signed ShaCraft
-v2 manifest. It does **not** launch Minecraft yet.
+The launcher persists local settings, synchronises Aeronautics mod/config
+files from the signed ShaCraft v2 manifest, installs the exact Minecraft +
+NeoForge version the manifest specifies, and launches the game. Players can
+launch either with a real Microsoft account or with a local offline profile
+(nickname + deterministic offline UUID) — see `docs/game-trust-boundary.md`
+and `AGENTS.md`'s trust model section.
+
+Not yet implemented: a user-selectable profile directory, a "reset managed
+files only" recovery action, and signed cross-platform release builds of the
+launcher itself. Do not represent these as completed in UI or release notes.
 
 ## Data flow
 
+Two independent pipelines feed one launch:
+
 ```text
-signed-manifest endpoint
-  -> Ed25519 verification in remote.rs
-  -> manifest schema + URL/path validation
-  -> local profile inspection
-  -> temporary download, SHA-256 verification, atomic replacement
+ShaCraft manifest (mods/config + which MC/loader/Java version to use)
+  signed-manifest endpoint -> Ed25519 verification (remote.rs)
+  -> manifest schema + URL/path validation (manifest.rs)
+  -> temporary download, SHA-256 verification, atomic replacement (profile.rs)
+
+Game itself (never controlled by the manifest above)
+  Mojang version manifest -> SHA-1-verified version JSON (mojang.rs)
+  -> Java 21 via Adoptium if none installed (runtime.rs)
+  -> NeoForge's own installer, run headlessly (neoforge.rs)
+  -> generic inheritsFrom merge of the two version JSONs (mojang.rs)
+  -> real Microsoft/Xbox/Minecraft Services login (msa.rs)
+  -> java process spawned with the merged classpath/args (launch.rs)
 ```
 
-Profiles live below Tauri's `app_data_dir()/profiles/<profile-id>`. Settings
-live at `app_data_dir()/settings.json`. Neither location should be assumed to
+Profiles (ShaCraft-managed mods/config, and the player's own worlds/
+screenshots/resourcepacks) live below Tauri's `app_data_dir()/profiles/
+<profile-id>` — this becomes `--gameDir`. The shared vanilla+NeoForge
+install (versions/libraries/assets/runtime, reused across profiles that
+target the same Minecraft version) lives at `app_data_dir()/game`. Settings
+live at `app_data_dir()/settings.json`, the Microsoft refresh token at
+`app_data_dir()/account.json` (mode 600). None of these should be assumed to
 be the system `.minecraft` directory.
 
 ## Aeronautics contract
@@ -25,15 +46,21 @@ be the system `.minecraft` directory.
 - Profile ID: `aeronautics`
 - Manifest endpoint:
   `https://shacraft.ru/api/launcher/v2/profiles/aeronautics/signed-manifest`
-- Payload: manifest schema v1, 251 managed files at the time of writing.
-- Download files: HTTPS only, exact hosts `shacraft.ru` and
+- Payload: manifest schema v1; also carries `minecraft.{version, loader,
+  javaMajor}` (currently 1.21.1, NeoForge 21.1.248, Java 21) — the launcher
+  reads this rather than hardcoding it, so a server-side version bump needs
+  no launcher release.
+- ShaCraft download files: HTTPS only, exact hosts `shacraft.ru` and
   `cdn.shacraft.ru`.
 
 ## Planned but not implemented
 
-1. Signed, cross-platform Java 21 runtime installation.
-2. User-selectable profile directory and structured launcher logs.
-3. Official Microsoft authentication and a compliant Minecraft/NeoForge launch
-   flow.
+1. User-selectable profile directory and structured launcher logs.
+2. "Reset managed files only" recovery action that doesn't touch player
+   worlds/screenshots/resourcepacks.
+3. Signed, cross-platform release builds of the launcher itself.
+4. Real per-stage byte progress for the Java/NeoForge install steps
+   (currently start/done only — the dominant, user-visible wait, asset
+   downloading, already reports real bytes).
 
 Do not represent these as completed features in UI or release notes.