Accept MCIAS JWT tokens as passwords at token endpoint

The /v2/token endpoint now detects when the password looks like a JWT
(contains two dots) and validates it directly against MCIAS before
falling back to the standard username+password login flow. This enables
non-interactive registry auth for service accounts — podman login with
a pre-issued MCIAS token as the password.

Follows the personal-access-token pattern used by GHCR, GitLab, etc.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/token.go

@@ -3,6 +3,7 @@ package server
 import (
 	"encoding/json"
 	"net/http"
+	"strings"
 	"time"
 )
 
@@ -21,14 +22,40 @@ type tokenResponse struct {
 
 // TokenHandler returns an http.HandlerFunc that exchanges Basic
 // credentials for a bearer token via the given LoginClient.
-func TokenHandler(loginClient LoginClient) http.HandlerFunc {
+//
+// If the password looks like a JWT (contains two dots), the handler
+// first tries to validate it directly via the TokenValidator. This
+// allows service accounts to authenticate with a pre-issued MCIAS
+// token as the password, following the personal-access-token pattern
+// used by GitHub Container Registry, GitLab, etc. If JWT validation
+// fails, the handler falls through to the standard username+password
+// login flow.
+func TokenHandler(loginClient LoginClient, validator TokenValidator) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		username, password, ok := r.BasicAuth()
-		if !ok || username == "" {
+		if !ok || (username == "" && password == "") {
 			writeOCIError(w, "UNAUTHORIZED", http.StatusUnauthorized, "basic authentication required")
 			return
 		}
 
+		// If the password looks like a JWT, try validating it directly.
+		// This enables non-interactive auth for service accounts.
+		if strings.Count(password, ".") == 2 {
+			if _, err := validator.ValidateToken(password); err == nil {
+				w.Header().Set("Content-Type", "application/json")
+				_ = json.NewEncoder(w).Encode(tokenResponse{
+					Token:    password,
+					IssuedAt: time.Now().UTC().Format(time.RFC3339),
+				})
+				return
+			}
+		}
+
+		if username == "" {
+			writeOCIError(w, "UNAUTHORIZED", http.StatusUnauthorized, "authentication failed")
+			return
+		}
+
 		token, expiresIn, err := loginClient.Login(username, password)
 		if err != nil {
 			writeOCIError(w, "UNAUTHORIZED", http.StatusUnauthorized, "authentication failed")