Enable the mssql-tds-preview crate's default sspi/gssapi features and
map AuthMethod::Integrated when integrated_auth is set. Accept
Integrated Security / Trusted_Connection in connection strings instead
of hard-rejecting them, and reject the combination with a
username/password instead of silently picking one.

Also accept the Command Timeout keyword as a client-side no-op,
matching the existing Connect Timeout handling.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

Co-Authored-By: Claude Sonnet 5 <[email protected]>

TabularisDB/tabularis#780 supersedes the host-side capability/field
approach from #775 with a generic connection-modal.extra_fields hook
(credentialFieldsHidden/setCredentialFieldsHidden) plus the existing
opaque extra map, so no core schema change is needed. Rebuild this
plugin's side on top of that:

- Add ui/, a Vite+React IIFE bundle (per PLUGIN_GUIDE.md) contributing
  the "Use Windows Authentication" checkbox to connection-modal.extra_fields,
  gated to driver "sqlserver". It writes extra.integrated_auth and calls
  setCredentialFieldsHidden; degrades to a visible-but-unhidden checkbox
  on hosts without that hook.
- ConnectionParams gains extra: HashMap<String, String>; resolve_connection_params
  now also resolves integrated_auth from extra["integrated_auth"] == "true",
  in addition to the existing Integrated Security=True connection-string path.
  Restructured the early-return so this works without a connection string.
- Fix build_connection_key: it never folded auth mode into the pool cache
  key, so editing a saved connection between SQL and Windows auth could
  reuse a stale pool built under the previous credentials.
- .tabularium: drop the now-unused supports_integrated_auth capability,
  add the ui_extensions entry for the new checkbox.
- README: document the checkbox as a UI extension instead of a discrete
  connection field.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

Four parallel reviews (code quality, test coverage, silent failures,
comment accuracy) on the current diff surfaced two real correctness
bugs and a CI gap, all fixed here:

- resolve_connection_params: a connection-string Integrated Security=False
  silently overrode an extra["integrated_auth"]=true with no error, unlike
  every other dual-sourced field in this function (which reconcile/reject
  on conflict). Now raises a contradiction error instead.
- extra["integrated_auth"] used a brittle exact match against the literal
  string "true", unlike this file's own parse_bool convention used for the
  same flag in connection strings (case-insensitive, hard-errors on
  garbage instead of silently defaulting to SQL auth). Now reuses parse_bool.
- ui/ was never typechecked or built in CI — only in release.yml, so a
  TypeScript error would first surface at release time. Added a ci.yml job
  mirroring explain-package's pattern, and switched release.yml to `npm ci`
  since ui/package-lock.json is committed.
- Added the missing test coverage the reviews identified: extra-map +
  connection-string agreeing/disagreeing on integrated_auth, and a
  driver/pool.rs test for the AuthMethod::Integrated branch.
- Fixed two doc comments left inaccurate by earlier edits in this branch
  (pool_manager.rs's illustrative key layout and README wording).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

Cut the ratio of prose to code introduced across this branch's edits.
No behavior change.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

IntegratedAuthToggle only called setCredentialFieldsHidden from onChange, so
reopening a saved connection with extra.integrated_auth=true left the
username/password inputs visible. Move the call into an effect keyed on the
flag so mount and load sync too.

Also require Tabularis 0.24.1-2 (first nightly containing
TabularisDB/tabularis#780) in .tabularium and the README, and add a vitest
regression test wired into CI.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

feat: support Windows/Kerberos integrated authentication