WIP: fix(desktop): show the Codex device sign-in code on connection-detail re-login

[sosyz]

Summary

The connection detail sheet's re-login notice (OAuthReloginNotice) drives the same browser-assisted OAuth flow as the provider catalog panel, but never rendered the flow's stateHint. For Codex that hint is the 9-digit device user code the authorization page requires — the verification URL is the static device page and does not embed the code — so a re-login started from the notice could never be completed: the browser asked for a code the app never showed.

• The re-login service mapping (oauthLoginServiceFor / OAuthLoginService) moves out of use-connection-detail.ts into a leaf module, oauth-relogin-service.ts, and gains a showsDeviceCode flag: true for Codex, false for xAI, whose authorization page needs no manual code (mirroring the catalog panel's existing !isXai guard). The leaf shape (no React, type-only imports at runtime) keeps the mapping loadable by the node:test suite.
• OAuthReloginNotice appends the sign-in code to the banner description while authorization is pending, reusing the catalog panel's deviceCode copy so both entry points speak the same words.

Fixes #3357

Verification

• npm run lint — clean
• npm run format:check — clean
• npm run typecheck (desktop: preload + main + renderer + storybook) — clean
• npm run build — clean
• npx knip --workspace apps/desktop — clean
• npm --workspace @maka/desktop test — 982 passed, 0 failed (978 before this PR + 4 new)

The new oauth-relogin-device-code.test.ts pins the per-service device-code contract (Codex showsDeviceCode: true, xAI false, non-browser-assisted providers null, and host-scoped bridge routing). The banner render itself has no existing component-test harness (the repo's fake DOM is deliberately hooks-only), so the JSX change is covered by typecheck and the contract pin rather than a render assertion.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code (Fable 5) performed the diagnosis, implementation, tests, and verification. The human contributor reviewed the result and authorized submission. The commit carries a Generated-by trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

🤖 Generated with Claude Code

[jackwener]

Automated Codex review on exact head dfe2323d669b2af8513c99d27a4060ea1be21334.

The bug still exists on current main: OAuthReloginNotice starts the shared OAuth flow but drops flow.stateHint, while the catalog path renders it for Codex. The JSX change correctly restores the required device code and excludes xAI.

P3 / simplification: the new 68-line test does not assert the repaired behavior. It only pins showsDeviceCode and bridge routing; deleting the <code>{deviceCode}</code> rendering would leave all four tests green. Moving the existing service mapping into a 44-line leaf module was done mainly to make that indirect test loadable, so the test creates an extra production seam without protecting the user-visible regression.

Prefer either:

• replace it with coverage that asserts the notice description actually contains Codex's stateHint and not xAI's; or
• if the repository has no honest component harness for this surface, delete the indirect test and keep the mapping in its existing owner, relying on focused human/UI verification rather than a misleading pin.

Required conclusions:

1. Optimal for the actual problem: functionally yes, structurally a little overbuilt.
2. Production code to delete: the extracted leaf module can be avoided if the indirect test is removed.
3. Tests to delete/replace: replace or delete oauth-relogin-device-code.test.ts as above.
4. Deeper refactor: no; the final structure should keep one service mapping and directly render stateHint at the notice.
5. Ready to merge: product logic is sound and required test is green, but independent human review is still missing; the test-quality cleanup is non-blocking.
6. Residual risk/gaps: no regression assertion currently fails when the rendered device code is removed.

This changes user-visible authentication behavior, so independent human review is required under CONTRIBUTING.md. No additional security, licensing, release, governance, or public-contract effect was identified.