v0.10.1

Lean-down release: the Alteryx One first-login flow no longer depends on a browser.

Removed: the Playwright fallback

The email-OTP first-login flow previously tried a pure-HTTP (reqwest) path and fell back to a Python/Playwright headless-Chromium subprocess on any failure. The pure-HTTP path has carried every operation through v0.10.0, so the browser fallback is removed.

What this means:

• No browser dependency. First-login no longer needs python3, playwright, or a chromium install (~400MB). On headless servers — the primary deploy target, and exactly where the subprocess was usually absent — this removes a failure mode rather than a safety net.
• Resolves the M4 security finding. The Playwright path passed the workspace password to the subprocess via an environment variable. With the subprocess gone, so is that exposure.
• Smaller surface. ~505 lines removed (including an embedded Python script), the unused tempfile dependency dropped, and two dead helpers (random_hex, wait_for_file, orphaned by the earlier pure-HTTP refactor) cleaned up.
• The AYX_ONE_AUTH_FORCE_BROWSER and AYX_ONE_AUTH_NO_FALLBACK environment variables are gone — there is no longer anything to force or fall back to.

The public email_otp_login signature is unchanged; for the common case (pure-HTTP succeeds) behavior is identical. The full browser implementation remains in git history should Alteryx ever change their OIDC flow.

Validation

• cargo fmt --all
• cargo clippy --workspace --all-targets -- -D warnings
• cargo nextest run --workspace --locked — 288 passed, 24 skipped (unchanged)