fix(provider): connect ChatGPT OAuth and fail its errors loudly

[winetree94]

Problem

Signing in with Sign in with ChatGPT completed the browser flow and then showed:

OpenAI — Limited connection · ChatGPT OAuth
This exception was thrown because the response has a status code of 400 …

OAuth itself was fine. Limited connection (degraded) is only reachable after a credential is stored, so the token exchange had succeeded — the 400 came from the step after it.

Root cause

ProviderService._discoverAndSave ran model discovery unconditionally. ChatGPT OAuth connections route to https://chatgpt.com/backend-api/codex, which serves only the Responses API and has no /models listing, so it answers 400. That classified as unavailable → degraded → the raw Dio message on the tile.

Changes

1. Skip discovery where it does not apply. ProviderRuntimeConfig.supportsModelDiscovery (default true) makes this an explicit typed property; only the ChatGPT OAuth branch sets it false, keeping the special case beside the base-URL override that already lives in _runtimeConfig. Those connections settle on the bundled catalog. The 400 classification is unchanged for endpoints that really do serve /models.

2. Fix six defects in the authorization flow, none of which could report themselves usefully:

• A denied authorization (?error=access_denied) was never parsed — the callback loop answered "Authorization code missing" and waited forever for a code that would never arrive.
• The callback binder silently fell back from port 1455 to 1457, producing a redirect_uri the public Codex client has not registered and an opaque 400. It now fails naming the busy port.
• A rejected token exchange leaked the raw Dio message; it now reports the OAuth error the token endpoint actually returned.
• That rejection also closed the server without answering, so the browser tab showed a connection reset instead of the reason.
• The device polling loop caught the exchange's DioException and mistook a rejection for authorization_pending, polling on until expiry.
• The callback page interpolated provider-supplied text into HTML unescaped.

New OAuthAuthorizationFailure returns the bare sentence from toString, since the coordinator publishes '$error' straight to the attempt tile.

Tests

Gateway: denied authorization, HTML escaping of <script> in error_description, rejected exchange (asserts no status code / DioException in the message), device loop halting on rejection (delays == 0), binder refusing to move off its port. Coordinator: the message reaches the attempt verbatim, without a class-name prefix. Service: discovery never called for ChatGPT OAuth, plus an API-key regression proving discovery still runs and still degrades. Also adapter defaults, a real-daemon vertical slice, widget, and e2e.

The e2e previously asserted contains('oauth-e2e-model') — a discovered model. That encoded the broken behavior and now asserts the bundled catalog instead.

The binder test uses port 0 and reuses the assigned port rather than closing and rebinding, avoiding a TOCTOU race; verified over repeated runs.

Verification

• dart run melos verify — all PASS
• dart run melos verify:debug — exit 0 (needed xvfb-run; this shell has no DISPLAY)

Not verified: a real ChatGPT sign-in end to end, and sending a message over the OAuth connection to confirm .../codex/responses works with the stored token.