feat(auth): expose subscription login methods and discover xAI endpoints

[uiharuayako]

Summary

• Expose the authorization methods advertised by each subscription provider in Model Settings.
• Offer explicit browser and device-code choices for local Codex sign-in; label OpenCode Console (Zen), xAI, and Hermes sign-in as device-code authorization, and Antigravity as browser authorization.
• Discover xAI device authorization and token endpoints through its OpenID configuration for login and refresh, with issuer and endpoint-origin validation.

No linked issue.

Type and Areas

Type: Feature / UI/UX

Areas: Web UI model settings, AI adapters subscription authentication, focused tests, adapter guide.

Motivation / Impact

Users running OpenBitFun on an unfamiliar machine may prefer to authorize from a phone or another computer where their account is already signed in. Codex already implements device-code authorization, but the local desktop sign-in action previously selected browser authorization without an explicit device-code choice. This change makes the supported methods visible and selectable.

Device authorization completes on another device while the OpenBitFun host receives and stores its own subscription credentials. This does not copy third-party credential files, synchronize existing accounts, or create a public OpenAI API key.

xAI endpoint discovery follows the approach used by CC-Switch. Each login or refresh reads the public discovery document using the existing subscription HTTP proxy configuration. A pending device grant retains the same discovered token endpoint throughout polling. Discovery errors are surfaced explicitly; inference URLs remain unchanged.

Verification

Re-run after moving the focused commit onto current upstream main:

• cargo test -p openbitfun-ai-adapters --features subscription-auth --lib subscription_auth: 82 tests passed.
• pnpm --dir src/web-ui exec vitest run src/infrastructure/config/components/subscriptionLoginCoordinator.test.ts: 12 tests passed.
• pnpm run check:web: passed (type checking, Appearance, typography, theme color and visual contracts).
• node scripts/check-git-object-sizes.mjs --base origin/main --head HEAD: passed; five changed blobs within policy.
• git diff origin/main...HEAD --check: passed.
• Public xAI OpenID discovery request succeeded and advertised the expected issuer, device/token endpoints, required scopes, and device-code grant. This checks terminal connectivity only, not the app's proxy path or account authorization.

AI-assisted implementation; testing level: lightly tested. Focused automated checks passed, but real-account device authorization, restart/reuse, token refresh and authenticated inference were not exercised.

Reviewer Notes

• Buttons derive from login_methods; older backends with an absent or empty field retain default sign-in behavior. Existing localized method labels are reused.
• Web/Peer Codex sign-in exposes device authorization rather than a callback on the controller. Antigravity retains its existing unsupported-surface gate.
• No persisted credential/config shapes, Tauri commands, dependencies or model inference routes changed. Existing accounts retain their credential and refresh behavior, with xAI now requiring discovery when refreshing.
• xAI endpoints must use HTTPS on auth.x.ai, port 443, without userinfo or fragments; issuer must match the expected issuer. Tests cover changed endpoint paths, missing fields, wrong issuers and unsafe origins.
• Remote workspace, Remote Control, Peer Device Mode and Detached Dispatch were not exercised end to end. Unit tests cover local/peer method selection and legacy capability payloads only.
• No rendered before/after screenshots or recording are included: native desktop UI and authenticated host sessions were not launched for this change. For UI review, open Model Settings with disconnected accounts: local Codex should offer both methods, device-only providers should display Device-code sign-in, and Antigravity should display Browser sign-in. Check pending/cancel/retry states and narrow settings panels.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.