[ewanc26]

What this changes

Blocked on Wolfram v0.38.0, which is not released yet. Do not merge until that release exists and wolfram.ref is bumped to it; this PR leaves wolfram.ref at v0.37.0 on purpose, so the 3DS link will fail on v0.37.0 until then.

The app-password sign-in no longer needs the PDS host. indigo_session_do_login calls Wolfram's wf_agent_login_discovered, which resolves the handle or DID, points the agent at the account's #atproto_pds endpoint and logs in there. The discovered PDS is what remember saves, so a resume goes straight to it. An empty Service falls back to INDIGO_DEFAULT_SERVICE (https://bsky.social) as the starting host.

The sign-in form is ready from a handle alone when a password is given. The Service field stays required for the browser (OAuth node) sign-in, which has no discovery step. The not-ready message now names the missing field.

Depends on: Wolfram v0.38.0 (wf_agent_login_discovered, from ewanc26/wolfram#187, not yet released).

Verification

Host: make test passes, 4046 checks, 0 failures. Covers the readiness rule: a handle alone is ready for a password sign-in, an empty handle never is, and the browser sign-in needs a Service. make warnings is clean. 3DS: make wolfram-3ds then make links indigo.3dsx against the feat/discover-pds checkout of Wolfram. Not run on a 3DS or in Azahar, and the discovery request has not been seen against a live PDS.

Docs

CHANGELOG.md: a Changed entry under [Unreleased] that links this PR. Blocked on Wolfram v0.38.0.

Changelog: Signing in with an app password needs only the handle; the Service field is kept for the browser sign-in.

Checklist

• CI is green (CI gate and flow / conventions)
• No secrets, tokens or signing keys in the diff
• Tests added or changed with the behaviour; none skipped, disabled or deleted

🤖 Generated with Claude Code