Windows Credential Provider

Host sign-in on Windows Pro — Kie.la tile on the logon screen, same passcode + PIN and phone Approve as Linux PAM.

Unlike Linux PAM, Windows does not create accounts. The session opened is the existing Windows user that carries the Pro persona email. Administrators stay on the classic password tile.

• Match a non-admin Windows account email to the Kie.la Pro persona.
• One-time enroll stores that account’s Windows password (DPAPI); Kie.la does not ask for it again.
• Source and install scripts live in the kwin/ tree of the platform repository.

Parallel to Linux PAM: same kgauth verify, different host binding.