Portal sign-in with the Ecare office login

Ecare staff sign in with their office username and password, checked by
the Ecare sign-in service from the backend (AUTH_TOKEN_API_URL); a good
Ecare login still needs a Portal User. Service down = "try again
shortly", never a wrong password. /api/auth/login, me, logout; sign-in
tries limited per address. Users page: Ecare office login or Portal
password per user. Context.md: 27/10 runs, the login retry bug.
71 test files, 1239 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Context.md

@@ -94,6 +94,15 @@ the one change is eCW data, not code: a patient's sliding fee was renewed
 (new period from 10/23/2026), so a claim with an earlier DOS is now Fail
 "Sliding fee NOT STARTED" (§6 Waiting 6). The #25 and Portal changes
 of 23–26/10 changed no other result.
+**2026-10-27 terminal runs:** 16:40 — 2FA mail never came in 10 min (eCW
+timed the approval out), then attempt 2 crashed: the run closed the Chrome
+it opened and re-attached to 9222 while that Chrome was still closing
+(`connect_over_cdp: Target page ... has been closed`; §10). 16:53 (after a
+120 s guard cooldown) — login 220 s, 2FA mail 42 s, **50/50, 38 Pass / 12
+Fail / 0 Review** (the 50-claim sheet; same as 26/10 17:40). 17:30 with
+`Mecor Ready 2 - 10262026.xlsx` (all claims, QUIET_BOXES, ECW_KEEP_OPEN=0)
+— login 98 s, **50/50, 30 Pass / 15 Fail / 5 Review**, the same as that
+file on 26/10. No bot error in either.
 
 **Runs page (2026-10-22, Stage 1 of EEWA-31..33, `751a177`):**
 http://127.0.0.1:8000/runs (header link "Runs"). Every Run writes
@@ -129,7 +138,24 @@ Start / Stop, Sign-ins page; adds / changes Viewers only), **Viewer**
 (Dashboard, Claim status, Runs; changes nothing, no Users or Sign-ins).
 Operator is gone (folded into Admin). The live table was moved 2026-10-27
 by the operator in SSMS (the bot's SQL login cannot ALTER the table): the
-one user is Super Admin; the CHECK allows only the three roles. Passwords PBKDF2-SHA256 (600k, own salt), 10+
+one user is Super Admin; the CHECK allows only the three roles.
+**Ecare office sign-in (`1da9e7c`, 2026-10-27, operator: the office login
+API, "only who we want"):** with `AUTH_TOKEN_API_URL` set
+(`https://auth-wfm.ecareindia.com/api/login/token`; public TLS cert, empty
+body = 401), a user added with sign-in "Ecare office login" (the Users
+page default) keeps no Portal password (`pw_iterations` 0): the backend
+posts their username + password there (15 s); 4xx = wrong password,
+5xx / timeout / 404 / 405 = 503 "try again shortly", a good login with no
+Portal User = 403 `no_access`. The Ecare token is not kept; same session
+cookie. `/api/auth/login` / `me` / `logout`; 20 tries per address per 15
+min = 429. "Portal password" users (the Super Admin's backup, clients)
+never reach Ecare. NOT live yet: `AUTH_TOKEN_API_URL` is in neither the
+PC's `.env` nor Dokploy, and no zip with it is deployed. Waiting: which
+fields the Ecare reply carries (name, emp id?) so the Add form can be
+username + role only and fill the name at first Sign-in —
+`D:\ecw-portal-deploy\ecare-fields.ps1` (prints field names, never the
+token or password) or AutoPilot's `backend/app/api/auth.py`.
+Passwords PBKDF2-SHA256 (600k, own salt), 10+
 characters; a user an Admin adds or resets must choose their own at the
 next Sign-in. 5 wrong passwords = locked 15 minutes; 30 minutes idle =
 signed out; sessions live in the server's memory (a restart signs everyone
@@ -187,8 +213,7 @@ Get-ChildItem tests\test_*.py | ForEach-Object { "$($_.Name): $((python $_.FullN
 - Tests run offline against fake HTML pages in `tests/fixtures/` and fake DB
   connections; they never touch eCW or SQL Server (`test_cdp_browser.py`
   starts a local Chromium on a debug port). As of 2026-10-27: 71 test
-  files, **1224 tests** (full run 2026-10-27: 1222/1222; the 2 Dockerfile
-  tests since, with test_portal_signin.py 24/24) (earlier flaky, each
+  files, **1239 tests** (full run 2026-10-27: 1239/1239) (earlier flaky, each
   failed once and passed on rerun: test_verify_no_live_writes,
   depression_dx_pointer, progress_note_wait — watch them) (about 5 minutes for all of them).
 
@@ -624,7 +649,8 @@ the Portal (restarted 2026-10-26, [portal] terminal tab).
 
 History: `git log --oneline`.
 
-Last code commits: `cc3a01a` (2026-10-27, Portal container on India time —
+Last code commits: `1da9e7c` (2026-10-27, Portal sign-in with the Ecare
+office login — §2), `cc3a01a` (2026-10-27, Portal container on India time —
 §10), `69c51d8` (2026-10-27, Dockerfile: libgssapi-krb5-2 for ODBC Driver
 18 — §10), `70ba709` (2026-10-27, Portal server mode for Dokploy — §10), `f99dc17` (2026-10-27, Portal roles Super Admin /
 Admin / Viewer — §2), `61338b4` (2026-10-26, Sign-in page redesign + tab
@@ -761,6 +787,11 @@ test claim ids — new posts must not (§7).
   watchdog came after them and has not fired live yet. Suggested, not
   ticketed: a landing-page timeout with one retry, a 2FA retry, a week of
   daily runs to measure login times on the Runs page.
+- **Login retry bug (seen 2026-10-27 16:50, not fixed).** After a 2FA
+  timeout the run closes the Chrome it opened and attempt 2 attaches to
+  9222 at once, while that Chrome is still closing → `connect_over_cdp:
+  Target page, context or browser has been closed`, run over. Fix: wait
+  until 9222 stops answering, then open a fresh Chrome (test-first).
 - **Gitea:** one overall snapshot update at the end of a day, when the
   operator asks (from the clone `D:\ecw-charge-validation`; operator
   pushes; 2026-10-26: `ba15a57` → `120fd68`).