[FEATURE] Add a fixed callback port for browser authentication

[rta-kklints]

Use Case / Problem

Interactive browser authentication currently lets MSAL choose an ephemeral localhost callback port. When Fabric CLI runs on a remote machine over SSH, users cannot reliably preconfigure port forwarding between the local browser and the remote callback listener.

Proposed Solution

Add fab auth login --redirect-port <port> for interactive user authentication.

Expected behavior:

• Accept ports 1 through 65535.
• Skip authentication-method selection and use browser authentication when interaction is required.
• Pass the fixed port to MSAL's local callback listener.
• Temporarily disable Windows/macOS authentication brokers so MSAL honors the port.
• Reject combinations with Azure CLI, managed identity, and service-principal options.
• Return an actionable error when the port cannot be bound.
• Preserve existing silent-cache behavior and all default login behavior when omitted.

Remote usage:

ssh -o ExitOnForwardFailure=yes -L 8400:127.0.0.1:8400 user@remote
BROWSER=echo fab auth login --redirect-port 8400

Alternatives Considered

• Device-code authentication: useful for headless environments but does not provide the same browser callback flow and is tracked separately in [FEATURE] Add device code authentication #215.
• Relying on an ephemeral port: cannot be forwarded predictably before login.
• Preflight-binding the port: introduces a race; the implementation should let MSAL perform the real bind.

Impact Assessment

• This would help me personally
• This would help my team/organization
• This would help the broader fabric-cli community

Implementation Attestation

• I understand this feature should maintain backward compatibility with existing commands
• I confirm this feature request does not introduce performance regressions for existing workflows
• I acknowledge that new features must follow fabric-cli's established patterns and conventions

Implementation Notes

I have a tested implementation ready in my fork and would like maintainer acknowledgment before opening the PR, per the contribution guide. Please add the help wanted label if the team accepts this contribution. The implementation includes parser, command, core auth, error handling, documentation, tests, and a Changie entry.

[microsoft-github-policy-service]

Thank you for submitting this issue, rta-kklints.
A member of the Fabric CLI team will review your submission and provide feedback shortly.

[rta-kklints]

I would like to contribute this feature. My planned approach is to thread --redirect-port from the auth parser through the user-login command into MSAL's acquire_token_interactive(port=...), temporarily disable platform brokers for that login attempt, validate incompatible/range-invalid inputs, normalize callback bind failures, and add focused parser/command/core tests plus SSH documentation and a Changie entry. The implementation preserves current silent-cache and default-login behavior. I will wait for team acknowledgment and the required help wanted label before opening the PR.

[rta-kklints]

https://github.com/rta-kklints/fabric-cli/tree/feature/login-redirect-port