Launcher: panel accounts via authlib-injector, skin & cape editor

Microsoft sign-in is gone. Server accounts now receive Yggdrasil tokens
from the panel and launch with authlib-injector pointed at the panel's
auth server, so online-mode servers verify players against it.

- Download authlib-injector from the panel mirror (fallback: official),
  SHA-256 verified and cached, with prefetched metadata
- New Skin & cape settings tab: upload, arm style, reset, cape picker
  with front/back previews
- Avatars render from the panel's head endpoint

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS

launcher/src-tauri/src/state.rs

@@ -1,7 +1,6 @@
 use crate::accounts::AccountsFile;
 use crate::secrets::Secrets;
 use crate::settings::Settings;
-use scopenet_core::msa::DeviceCode;
 use scopenet_core::Layout;
 use scopenet_shared::LauncherManifest;
 use std::path::PathBuf;
@@ -34,8 +33,6 @@ pub struct AppState {
     pub accounts: RwLock<AccountsFile>,
     pub secrets: Secrets,
     pub manifest: RwLock<Option<LauncherManifest>>,
-    pub device_code: Mutex<Option<DeviceCode>>,
-    pub ms_cancel: Mutex<Option<tokio::sync::oneshot::Sender<()>>>,
     /// Install/launch pipeline in progress (abortable).
     pub task: Mutex<Option<tokio::task::AbortHandle>>,
     pub game: Mutex<Option<RunningGame>>,
@@ -54,8 +51,6 @@ impl AppState {
             settings: RwLock::new(settings),
             accounts: RwLock::new(accounts),
             manifest: RwLock::new(manifest),
-            device_code: Mutex::new(None),
-            ms_cancel: Mutex::new(None),
             task: Mutex::new(None),
             game: Mutex::new(None),
             data_dir,