VAG Connect v2.10.3

VW EU users finally get a working read-only path again.

What's new

caraar12345 posted a complete v2.10.2 debug trace on #388 showing all three auth strategies still failing:

Strategy #0 hybrid_full: HTTP 403 at the authorize endpoint with both Android UA and v2.10.1 browser-UA retry. The Azure WAF is fingerprinting the Android client_id, not just the user-agent.
Strategy #1 classic auth-code: login succeeds and returns a code, but the BFF token exchange returns HTTP 400 invalid assertion headers - the Play Integrity wall we cannot get past from Python.
Strategy #2 data_act_portal: lands on the SPA-rendered password page. v2.10.2 detected it but raised with "JSON SPA fallback in idk.py is the supported route" - except idk.py runs the BFF client, not the portal client, so this path was a dead-end for users.

Data Act portal completes the SPA-rendered password page itself (#388). Form-encoded POST with action=default and the state lifted from the URL query string, then the standard token exchange from v2.10.2. The callback validation + token POST is factored out into a helper so both the static-form and SPA-password paths share it. The portal client_id passes the WAF where the Android client_id is blocked, so this is the path most affected VW EU users can actually walk.

HACS users: the update notification appears automatically within ~6 hours.

Manual install:

Download vag_connect.zip from this release
Unzip and copy custom_components/vag_connect/ to your HA config/custom_components/ folder, replacing any older copy
Restart Home Assistant

Please mask your VIN to the last 6 characters and remove email/tokens/GPS before posting.