feat(desktop): expose multiple OAuth connection accounts in Models settings

[me2seeks]

Parent

• [Tracking] Explicit multi-account provider connections across Runtime Host surfaces #3852
• Follows feat(runtime-host): bind OAuth login to Connection entities #3924

Problem

Runtime Host now binds OAuth attempts to an exact Connection entity, but Desktop still presents OAuth providers as aggregate provider cards in the Catalog. That leaves several surface-level gaps:

• an existing account can make the Catalog add flow look like provider-wide account management;
• successful OAuth completion does not return the canonical connectionId + slug to the renderer, so the surface cannot reliably open the newly created entity;
• provider detail routes use the reusable slug instead of immutable connectionId;
• account status, refresh, and logout can still be requested through an aggregate provider adapter instead of an exact Connection.

UX decision

• Connections is the entity list and owns per-account status and management.
• Provider Catalog is an add-account destination. OpenAI Codex and xAI rows always mean "add another account"; they do not expose aggregate login/logout state.
• GitHub Copilot remains a distinct singleton/direct-import flow in this slice.
• Duplicate account names are disambiguated as name · slug.

Catalog supporting copy reflects the number of configured Connections:

• 0: "Use a ChatGPT / Codex account to add a connection"
• 1: "1 connection configured · Add another account"
• N: "N connections configured · Add another account"

Scope

• Replace nullable Desktop OAuth targets with explicit create / existing(connectionId) intent at the local IPC seam.
• Return the Host-validated canonical Connection identity on successful completion and use it as the only post-login navigation authority.
• Split renderer authorization flow from exact-account state/refresh/logout management; create mode must not read or mutate aggregate provider account state.
• Route internal Connection detail navigation by immutable connectionId; an external legacy slug may be resolved once at the boundary.
• Keep logout scoped to the exact Connection and separate from destructive Connection deletion.
• Preserve the current default Connection when another account is added.
• Preserve Runtime Host single active interactive OAuth presentation and generation/conflict checks.
• Restore keyboard focus to the originating Catalog row after cancel/back, announce success/error/external deletion, and keep the setup panel a named region.
• Add focused main-process tests, renderer tests/E2E where appropriate, and Storybook states for 0/1/multiple accounts plus canonical-success routing.

Acceptance criteria

• Two or more openai-codex Connections and two or more xai-oauth Connections are independently visible and manageable in Desktop Models settings.
• Starting "add another account" never logs out, refreshes, or reuses an existing provider account implicitly.
• Successful OAuth completion returns an exact Host-validated connectionId + slug; after a catalog reload, Desktop opens that entity even if ordering changed.
• Status, refresh, logout, relogin, and detail navigation operate on the selected immutable connectionId.
• Deleting or replacing a same-slug Connection cannot silently switch an open detail page to another entity.
• Duplicate display names remain distinguishable.
• Cancel/back restores focus to the initiating Catalog row; important state changes are announced accessibly.
• Adding an account does not silently change the default Connection.

Non-goals

• Runtime Host protocol or compatibility-epoch changes
• Storage schema or credential migration
• Desktop API-key onboarding convergence
• Multiple GitHub Copilot accounts
• Per-Connection concurrent OAuth presentation lanes
• ScheduledTask identity (feat(runtime-host): bind ScheduledTasks to immutable Connection identity #3927)
• Automatic balancing, fallback, or implicit Session rebinding

Validation

• Main-process OAuth IPC identity tests
• Focused Desktop renderer unit tests
• Settings Storybook states for zero, one, and multiple OAuth Connections
• Focused keyboard/navigation E2E for add, cancel, completion, exact detail, and external deletion
• Existing OAuth detail refresh/logout and connection management tests remain green