Implement TUI authentication and inactivity relock

apps/tui/src/ui.rs

@@ -222,12 +222,18 @@ fn mode_title(mode: Mode) -> &'static str {
 
 fn status_line(app: &App) -> Paragraph<'_> {
     let busy = if app.is_busy() { " [working]" } else { "" };
+    let warning = app
+        .remaining_lease()
+        .filter(|remaining| remaining.as_secs() <= 30)
+        .map_or_else(String::new, |remaining| {
+            format!(" [locks in {}s]", remaining.as_secs())
+        });
     Paragraph::new(Line::from(vec![
         Span::styled(
             " status ",
             Style::default().bg(Color::Blue).fg(Color::White),
         ),
-        Span::raw(format!(" {}{busy}", app.status())),
+        Span::raw(format!(" {}{busy}{warning}", app.status())),
     ]))
 }
 
@@ -370,4 +376,12 @@ mod tests {
         let wide = render(140, 20, &app);
         assert!(wide.contains("Browser"));
     }
+
+    #[test]
+    fn lease_warning_is_concise_and_never_contains_entry_state() {
+        let mut app = App::new();
+        app.update_remaining_lease(Some(std::time::Duration::from_secs(30)));
+        let output = render(100, 20, &app);
+        assert!(output.contains("locks in 30s"));
+    }
 }