Resolve Desktop person identity through authenticated Cloud API

[benceruleanlu]

Behavior

Add a main-process Cloud identity client for GET /api/user. Keep the canonical account ID separate from the optional firebase_uid used by existing Customer.io profiles. Legacy responses without that field remain usable account responses; callers must not substitute the canonical ID for a Firebase UID.

CloudSession shares concurrent identity lookups and announces credential changes immediately. Logout, login completion, active-token refresh, and workspace switches cancel obsolete lookups; a late response cannot supply the previous account's identity. Tokens remain in the main process. This library layer is consumed by launcher messaging later in the stack.

The optional field requires Cloud #9467 and #9468 before launcher messaging can identify newly authorized sessions. Existing grants need fresh authorization to acquire proven Firebase provenance.

Validation

28 focused Cloud identity/session tests passed. Coverage includes linked identities, absent legacy metadata, rejected/malformed responses, cancellation, shared requests, logout and workspace-switch races. Required pre-commit typechecks, lint, and formatting passed. No live authenticated request or deployment was performed.

Change breakdown

Changed lines = additions + deletions. No merge-only changes.

Category	Files	Added	Deleted	Share of changed lines
Test code	2	153	0	61.9%
Product code	2	93	1	38.1%
Total	4	246	1	100%

Test code paths

• src/main/cloud/identity.test.ts
• src/main/cloud/session.test.ts

Product code paths

• src/main/cloud/identity.ts
• src/main/cloud/session.ts

No generated or vendored files changed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}