[theophile-wallez]

What breaks today

login --web mints a token for every session and puts it in the link. The
browser keeps that link in its history and offers it back in the address bar, so
the next session gets a token that has expired with the session that minted it.
The viewer answers 403 Forbidden with a body of two words, wrong token, in
text/plain.

Those two words are true and useless. The reader cannot tell them from a broken
viewer, and the one thing they have to do — take the link that this run printed —
is not in them.

What this changes

A refused page load (GET /) now answers with a page that says three things:
the link belongs to a session that has ended, the terminal printed the current
one, and the address bar completes the stale one.

The paths the script itself calls (/delta, /input, /quit) keep the plain
body, because the script reads the status code and never the text. The token
check, the constant-time comparison and the per-session token are unchanged: this
touches the message and nothing about what the viewer lets through.

print_url says the same thing at the point where the reader is about to copy
the link.

Tests

• A unit test asserts the page names the command, the shape of the link and the
  token's length, and that it no longer holds the string it replaces.
• The end-to-end test a_browser_client_sees_the_display_and_types_into_it now
  asserts that /delta with a wrong token keeps the plain body, and that a page
  load with a stale token gets the page.
• cargo test --lib: 75 passed. cargo test --lib -- --ignored a_browser_client:
  passed against a real Xvfb display. cargo fmt --check and
  cargo clippy --lib -- -W clippy::all: clean.

I also drove the server with a real browser to confirm the diagnosis: a correct
link serves the display and polls /delta at 200, and a token from an earlier
session renders the bare wrong token page that this replaces.