fix: prevent callback shutdown from blocking login

[jlitola]

Summary

• force-close temporary OAuth callback connections after the browser response finishes or closes
• continue token exchange, credential persistence, timeout reporting, and callback-error reporting without awaiting listener teardown
• cover proxied keep-alive callbacks, close-before-finish responses, and non-resolving shutdown with regressions
• document callback shutdown behavior for remote environments

Root cause

The login flow awaited HTTP server close before exchanging the authorization code. A sandbox port proxy could keep the callback connection alive after rendering the success page, leaving init blocked indefinitely. The callback result also depended only on the response finish event, so an early connection close could leave a valid callback unsettled.

Review follow-up

• settle callback results on both response finish and close
• make listener cleanup non-blocking on success, callback error, and timeout paths
• remove the test-only CallbackServerHandle port field
• make shutdown-order assertions explicit and add real listener regressions
• harden callback socket tests against probe/rebind collisions and limit the response prototype spy to the request window

The Biome schema alignment and removal of a forbidden non-null assertion are validation-only cleanup surfaced by this change; they do not affect callback behavior.

Validation

• bun run format:check
• bun run lint
• bun run typecheck
• bun test (2579 passing)
• callback socket regressions repeated 20 times (40 passing)
• bun run build
• bun run plugins:generate
• bun run plugins:check
• bun run smoke:cli (70 steps, authenticated live smoke passed)
• bun run smoke:mcp (38 steps, authenticated live smoke passed)
• bun run smoke:cli:built
• bun run smoke:mcp:built

[jlitola]

Addressed the Fable review in b31d724:

• callback result now settles on response finish or close
• shutdown is non-blocking on callback failure and timeout paths too
• removed CallbackServerHandle.port
• cleaned up the ordering test so assertions cannot be swallowed
• added deterministic close-before-finish and non-resolving-close regressions

I retained the Biome schema alignment and non-null cleanup, and called them out explicitly in the PR body because reverting them restores current lint diagnostics.

Final deterministic validation passes. The live authenticated backend was unhealthy during rerun (MCP 60s timeout; CLI request stalled beyond five minutes); this is recorded in the PR body.

[jlitola]

Addressed both round-2 test findings in 84ef745:

• callback test startup now retries the probe/close/rebind sequence up to three times, and only for EADDRINUSE
• the ServerResponse.end spy is installed only after server startup and socket connection, immediately before socket.write
• added a comment explaining why the response is destroyed server-side to deterministically exercise close without finish

Validation: 2579 tests pass, focused socket regressions pass 40/40, formatting/lint/types pass, build passes, and generated plugin assets validate.

[jlitola]

Live smoke rerun passed on the host after respecting the backend rate-limit cooldown:

• bun run smoke:cli — passed all 70 steps, including authenticated live calls and CLI/MCP JSON parity
• bun run smoke:mcp — passed all 38 steps, including authenticated live calls

The PR validation section has been updated to replace the earlier backend-timeout/rate-limit note.