fix(preflight): never force interactive ADC login on VM; use metadata service-account

Powered by Jason, Crafted by Vauco

scripts/preflight.sh

@@ -23,13 +23,18 @@ else
   exit 1
 fi
 
-# 2. ADC
+# 2. ADC (Application Default Credentials)
+# På en GCE-VM leveres ADC automatisk av metadata-serveren — ALDRI tving
+# interaktiv 'gcloud auth application-default login' (browser-kode henger på VM).
 if gcloud auth application-default print-access-token >/dev/null 2>&1; then
   ok "ADC (application-default)"
+elif curl -s -H "Metadata-Flavor: Google" \
+     "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" \
+     >/dev/null 2>&1; then
+  ok "ADC (VM metadata service-account)"
 else
-  warn "ADC ikke satt — kjører: gcloud auth application-default login --no-launch-browser"
-  gcloud auth application-default login --no-launch-browser \
-    --scopes="https://www.googleapis.com/auth/cloud-platform"
+  warn "ADC ikke tilgjengelig. På VM: sjekk at instansen har en service-account."
+  warn "Manuelt (kun hvis nødvendig): gcloud auth application-default login"
 fi
 
 # 3. Prosjekt