feat(homeassistant): an admin signs in to Home Assistant, with nothing added to it (#6355)

Replaces the read-only token and the webhook automation, which every install
would have had to paste into its own Home Assistant. Connect now goes to Home
Assistant's own sign-in page, and Steward keeps the refresh token that comes
back, encrypted, and calls backup.create_automatic and update.install directly.

The connection page warns that the stored credential has the same access as
the user who signed in, and recommends a service account so Steward's actions
are easy to tell apart in Home Assistant's logs. A user who isn't an
administrator gets the status page and no Install.

Those actions answer only when finished, so a request cut off once sent counts
as sent and the outcome is read from the entities. Removing the connection, or
signing in again, ends the old sign-in on Home Assistant.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/homeassistant/templates/homeassistant/index.html

@@ -12,7 +12,8 @@
 {% endcall %}
 
 {% if not connection %}
-<div class="card">{{ empty_state("Not connected. Connect a Home Assistant instance to see its waiting updates and backups, and to install updates after a confirmed backup.",
+{% if error %}<p class="field-error" role="alert">{{ error }}</p>{% endif %}
+<div class="card">{{ empty_state("Not connected. Sign in to a Home Assistant instance to see its waiting updates and backups, and to install updates after a confirmed backup.",
                                  "Connect" if admin else none, "/plugins/homeassistant/connection") }}</div>
 {% else %}
 {% if error %}<p class="field-error" role="alert">{{ error }}</p>{% endif %}
@@ -29,9 +30,9 @@
   {% else %}{{ status_badge('pending', 'Not read yet') }} {{ says }}{% endif %}
 </p>
 
-{% if connection.last_ok_at and connection.automation != 'on' %}
-<p class="tone-warn">{% if connection.automation %}The Steward maintenance automation is {{ connection.automation }} in Home Assistant{% else %}The Steward maintenance automation isn't in Home Assistant{% endif %}, so updates can't be installed from here.
-  {% if admin %}<a href="/plugins/homeassistant/connection">See what to add.</a>{% endif %}</p>
+{% if not connection.can_install %}
+<p class="tone-warn">The Home Assistant user who signed in isn't an administrator, so updates can't be installed from here.
+  {% if admin %}<a href="/plugins/homeassistant/connection">Sign in again</a> as an administrator to install them.{% endif %}</p>
 {% endif %}
 
 <div class="stat-strip">
@@ -53,7 +54,7 @@
         <td class="mono">{{ u.installed or "—" }}</td>
         <td class="mono">{% if u.release_url %}<a href="{{ u.release_url }}" rel="noopener noreferrer" target="_blank">{{ u.latest or "—" }}</a>{% else %}{{ u.latest or "—" }}{% endif %}</td>
         {% if admin %}<td style="text-align:right;">
-          {% if connection.automation == 'on' and not under_way and not connection.refused and not u.in_progress %}
+          {% if connection.can_install and not under_way and not connection.refused and not u.in_progress %}
           <form method="post" action="/plugins/homeassistant/install"
                 data-confirm="Install {{ u.title }} {{ u.latest }}? Steward takes a backup first and won't install without it. {{ 'Home Assistant restarts.' if u.kind == 'core' else ('The machine reboots.' if u.kind == 'os' else 'The add-on restarts.') }}">{{ csrf_field() }}
             <input type="hidden" name="entity_id" value="{{ u.entity_id }}">