mcp-reauthlisted

# MCP re-auth, browser-driven Converts the Teams MCP re-auth from a manual context-switch into a mostly-automated flow where the user's only action is a biometric or MFA approval. `teams-mcp` signs in as a public client against the tenant and app registration named by `TEAMS_MCP_TENANT_ID` and `TEAMS_MCP_CLIENT_ID` (environment variables — the server refuses to start the flow without them). The resulting record and token cache persist under `%LOCALAPPDATA%\teams-mcp\`, so this flow is needed once per machine and then only when the record dies. ## Step 0 — probe before you authenticate Call a cheap Teams tool first (`list_chats` with `limit: 1`), or from a shell run `teams-mcp selftest`, which does a silent-auth Graph round-trip and prints raw errors. **Only run the flow below if the probe fails.** An existing token cache does NOT short-circuit `teams-mcp auth` — it runs the full interactive flow regardless, so re-running it against healthy auth costs the user an entire sign-in for nothing. ## The flow 1. **Start the sign-in in the background** (`run_in_background: true`): ``` teams-mcp auth ``` Device-code is the default. (`TEAMS_MCP_AUTH=browser` switches to a browser pop-up flow — that variant needs no driving at all beyond the user completing the pop-up, so the rest of this skill is about the device-code path.) 2. **Scrape the device code from the task output.** Azure.Identity prints the standard Microsoft instruction line — a URL (typically `https://m