Make installer interactive for credential source selection

app/Sources/LemanaVPN/VPNManager.swift

@@ -10,6 +10,7 @@ struct VPNEvent: Decodable {
     var delay: Int?
     var reason: String?
     var message: String?
+    var source: String?
     var tier: Int?
     var modules: ModuleStatus?
 }
@@ -31,6 +32,11 @@ struct ModuleStatus: Decodable {
         var installed: Bool
     }
 
+    struct Credentials: Decodable {
+        var source: String
+        var keychain_ready: Bool
+    }
+
     struct Keychain: Decodable {
         var password: Bool
         var totp_seed: Bool
@@ -51,6 +57,7 @@ struct ModuleStatus: Decodable {
     }
 
     var core: Core
+    var credentials: Credentials?
     var bitwarden: ToggleModule
     var touchid: ToggleModule
     var keychain: Keychain
@@ -80,6 +87,7 @@ struct ModuleStatus: Decodable {
 
     var summary: String {
         let coreState = core.openconnect && core.openconnect_lite && core.openconnect_lite_config ? "✅ core" : "⚠️ core"
+        let credentialState = credentials.map { "🔐 \($0.source)" } ?? "🔐 legacy"
         let bwState = bitwarden.enabled ? (bitwarden.installed ? "✅ bw" : "⚠️ bw") : "⏭️ bw"
         let touchState = touchid.enabled ? (touchid.installed ? "✅ touch" : "⚠️ touch") : "⏭️ touch"
         let dnsState = dns_cleanup.installed ? "✅ dns" : "⚠️ dns"
@@ -87,7 +95,7 @@ struct ModuleStatus: Decodable {
         let autostartState = app.map { $0.autostart ? "✅ autostart" : "⏭️ autostart" } ?? "❔ autostart"
         let patchState = patches.active ? "✅ patches" : "⚠️ patches"
         let keychainState = "\(keychain.password && keychain.totp_seed ? "✅" : "⚠️") kc \(keychain.password ? "pass" : "-")/\(keychain.totp_seed ? "totp" : "-")"
-        return [coreState, bwState, touchState, dnsState, appState, autostartState, patchState, keychainState].joined(separator: " | ")
+        return [coreState, credentialState, bwState, touchState, dnsState, appState, autostartState, patchState, keychainState].joined(separator: " | ")
     }
 }
 
@@ -366,6 +374,13 @@ class VPNManager: ObservableObject {
             switch event.event {
             case "modules":
                 return
+            case "credential_source":
+                if let message = event.message {
+                    log("  \(message)")
+                } else if let source = event.source {
+                    log("  Credential source: \(source)")
+                }
+                return
             case "bw_cached":
                 state = .unlocking(tier: "cached")
             case "bw_touchid":