refactor(auth): share OAuth session setup shell

[beruro]

Problem

Claude Code and Codex session setup duplicated the same OAuth WebView workflow and UI: local browser intent, delayed native start, success collapse, external close handling, retry, loading/error/success surfaces, progress indicators, alerts, and debug chrome. Provider fixes could drift even though only token response mapping and copy differ.

Solution

Introduce one OAuth session setup shell and a render-only view. Provider adapters keep their existing typed capture hooks and credential mapping, then supply normalized capture state and localized copy to the shell. The shared lifecycle preserves idle → requested → starting/loading → open → success/error → retry/close behavior, preserves Codex auto-start, coalesces duplicate retry clicks, and keeps timer/native WebView cleanup at the owning boundary. Add localized names for icon-only refresh/close controls, status/alert semantics, and aria-current for the active step.

Potential risks

A shared shell means a lifecycle regression could affect both providers. The extracted transition predicates, parent render gates, OAuth parsing, and WebView position lifecycle are covered by focused tests; provider-specific response mapping remains unchanged and typechecked. The actual native WebView plus live OAuth exchange was not manually exercised in this environment, so desktop-runtime integration remains the main unverified path. Rollback is a single-commit revert.

Lifecycle and ownership

• User trigger: provider sign-in button or Codex auto-start. Completion: the provider capture hook returns tokens, closes its native WebView, and the shell collapses to the signed-in state.
• Runtime ownership: provider hooks own OAuth request/exchange state and native WebView identity; the shared shell owns only transient visible-browser intent; the wizard parent receives visibility for layout/footer gating. No new persistence or second token source was introduced.
• Failure/retry: errors stay visible in the browser shell, retry resets the capture hook and starts once, and rapid duplicate retries are coalesced. External close closes the native WebView and restores the idle form.
• Effects: initial visibility synchronizes the owning wizard layout; native WebView completion collapses the shell; a 100 ms native-start timer is cleared on dependency change/unmount; external close signals call an idempotent close path. Existing WebView position/listener cleanup remains in the capture hooks.
• Performance verdict: pass. No polling, cache, subscription, scan, or retained collection was added; the sole delayed-start timer is conditional and cleaned up, and duplicate retry work is bounded.

Architecture and UI audit

• Covered UI/runtime ownership, state transitions, provider boundary types, dependency direction, error precedence, auto-start/init parity, duplicate actions, WebView lifecycle, and accessibility.
• Intentionally skipped persisted schema, collaboration, backend wire changes, and database layers because they are unchanged.
• Frontend UI audit: 2 abstracts, 3 fixes, 2 keep-with-reason, 0 sweep candidates. Report: docs/frontend-ui-audit-2026-08-11/OAuthSessionSetup.md.

Verification

• pnpm exec vitest run src/features/SessionSetup/components/OAuthSessionSetupShell.test.ts src/hooks/workStation/sessionCapture/__tests__/useOAuthCapture.test.ts src/hooks/workStation/sessionCapture/__tests__/useWebviewPositionSync.test.ts — 3 files, 43 tests passed.
• pnpm exec eslint src/features/SessionSetup/components/OAuthSessionSetupShell.tsx src/features/SessionSetup/components/OAuthSessionSetupShell.test.ts src/features/SessionSetup/components/ClaudeCodeSessionSetup/index.tsx src/features/SessionSetup/components/CodexSessionSetup/index.tsx — passed.
• pnpm exec prettier --check ... for the four source/test files and audit report — passed.
• pnpm typecheck — full TypeScript check executed and passed.
• git diff --check — passed.
• The repository snapshot does not provide verify:quick or verify:final, so focused tests/lint plus the full typecheck entry point were used.
• No screenshots: visual structure and copy are preserved; changes are lifecycle consolidation and additive accessibility semantics.
• Not run: live/native OAuth login, because it requires the desktop WebView runtime and provider interaction.

[beruro]

Superseded by #780, which preserves this change as an independent commit and has passed the consolidated CI suite. The source branch is retained for recovery.