refactor(auth): share OAuth session setup shell

docs/frontend-ui-audit-2026-08-11/OAuthSessionSetup.md

@@ -0,0 +1,21 @@
+# Frontend UI Audit — OAuth Session Setup
+
+Scope: the Claude Code and Codex OAuth session-setup components plus their extracted shared shell. Provider-specific credential mapping remains outside the shared presentation/lifecycle boundary.
+
+| Line                                                                       | Element                                               | Verdict          | Reason                                                                                                                                                                                                              | Suggested change                                                                                        |
+| -------------------------------------------------------------------------- | ----------------------------------------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
+| `src/features/SessionSetup/components/OAuthSessionSetupShell.tsx:63`       | OAuth idle/browser/loading/error/success presentation | abstract         | Claude Code and Codex duplicated the same section layout, WebView chrome, progress indicator, overlays, alerts, and debug container. A provider-copy contract preserves localized differences without parallel JSX. | Reuse one shell and pass provider copy/test identity explicitly.                                        |
+| `src/features/SessionSetup/components/OAuthSessionSetupShell.tsx:286`      | OAuth browser lifecycle                               | abstract         | Both providers used the same open, delayed native start, success collapse, retry, parent-layout sync, and external-close transitions. One owner makes cleanup and duplicate retry policy consistent.                | Keep transient browser intent in the shared shell; retain provider capture state in the existing hooks. |
+| `src/features/SessionSetup/components/OAuthSessionSetupShell.tsx:123`      | Refresh and close icon buttons                        | fix              | The duplicated icon-only controls had no accessible names. The shared shell can apply localized labels once for both providers.                                                                                     | Add `aria-label` and `title` from existing common actions copy.                                         |
+| `src/features/SessionSetup/components/OAuthSessionSetupShell.tsx:172`      | Loading and error overlays                            | fix              | Visual states existed but did not expose status/alert semantics to assistive technology.                                                                                                                            | Mark loading as `role="status"` and errors as `role="alert"`.                                           |
+| `src/features/SessionSetup/components/OAuthSessionSetupShell.tsx:391`      | Two-step progress indicator                           | fix              | Active styling was only visual.                                                                                                                                                                                     | Expose the active item with `aria-current="step"`.                                                      |
+| `src/features/SessionSetup/components/ClaudeCodeSessionSetup/index.tsx:58` | Claude Code capture and account metadata mapping      | keep with reason | Claude Code owns its callback response and optional organization metadata; generalizing this mapping would weaken provider types.                                                                                   | Keep mapping in the provider adapter and pass normalized capture state to the shell.                    |
+| `src/features/SessionSetup/components/CodexSessionSetup/index.tsx:41`      | Codex capture and required token mapping              | keep with reason | Codex requires refresh and ID tokens and supports initial auto-start. Those are provider contract differences, not presentation variants.                                                                           | Keep mapping and auto-start input in the provider adapter.                                              |
+
+## Summary
+
+- Fix: 3
+- Keep with reason: 2
+- Abstract: 2
+- Sweep candidates: 0
+- Visual behavior: unchanged; accessibility semantics are additive.