Stage OpenAI OAuth credentials until setup validation

[TheGreatAxios]

Summary

• Stages OpenAI OAuth tokens in memory and commits them only after setup validation succeeds.
• Treats definitive OAuth scope and credential rejections as non-saveable and blocks Ctrl+S for those failures.

Verification

• bun run check passes.
• 116 targeted auth/TUI tests pass.

Fixes CL-7115

[linear-code]

CL-7115

[TheGreatAxios]

Review · Approve

OAuth credentials no longer become durable before setup validation succeeds.

No findings.

[TheGreatAxios]

Review · Approve

Stages Codex/xAI OAuth tokens in memory after the PKCE exchange and commits them to the home auth store only when provider setup's scope probe passes (or the operator explicitly saves anyway); definitive scope/credential rejections block Ctrl+S.

No findings.

Notes

• Conflicts textually with #706 in src/tui/provider-setup-submit.ts (git merge-tree --write-tree → CONFLICT): #706 rewrites the same OAuth-branch comment block, adds a providers[oauth.providerName] entry to the saveGlobalSettings call, and makes localSettingsFile: string | null. Resolution: keep await oauth.commit() ahead of saveGlobalSettings and add #706's providers spread. #705 merges clean and has no behavioral interaction (commit happens before settle(true), so the reload sees the profile).
• Commits "Fix staged OAuth credential validation retries" and "Clean OAuth setup hygiene" amend code introduced earlier on this same branch (commit-retry logic, insufficient-scope → blocked rename). Squash them into the commits they fix; "Clean OAuth setup hygiene" is too vague to stand alone.
• src/auth/oauth-scope-check.ts:76-80 — isDefinitiveRefreshAuthRejection matches /invalid_grant|revoked/i on the raw body, so a 400 without those words is treated as transient and save-anyway stays available. Consistent with the never-lock-out policy; noting for awareness.
• Verified: no tokens reach settings.json (provider-setup-submit.ts:65-72 writes only defaultProvider + local selection; commit goes through saveCodexProfile/saveXaiProfile → writeAuthFile tmp+rename/0600, untouched); nothing on disk before commit(), so Ctrl+C/Esc/validation failure/deadline leave no orphan profile; refreshed staged tokens are the object commit saves (session.ts:60-62, provider-setup.ts:1379-1384, login.ts:61-75); Ctrl+S gate enforced in the key handler (provider-setup.ts:1714-1715), not just guidance text; no callers of startCodexLogin/startXaiLogin outside provider-setup.ts.
• Checks: bun run typecheck, bun run lint (0 warnings on the 19 touched files), bun test src/auth/callback-page.test.ts src/auth/oauth-scope-check.test.ts src/auth/oauth/oauth.test.ts src/tui/provider-setup-submit.test.ts src/tui/provider-setup.test.ts (116 pass).