Fix Ollama authentication

[Finesssee]

Summary

• Adds current WorkOS AuthKit wos-session support with exact legacy and numeric-chunk NextAuth cookie matching.
• Treats Ollama/WorkOS sign-in redirects as expired authentication.
• Trims API keys and validates them at authenticated POST /api/web_search before public /api/tags.
• Refactors credentialed redirect handling to use the shared crate-visible core::is_same_origin comparator and extracts the Ollama settings redirect sequence into fetch_settings_html_at.

Upstream mapping

• 30ae39a7e: AuthKit cookie discovery and manual validation.
• aa401f1d8: WorkOS/sign-in redirect classification.
• 8f4cf6819: authenticated API-key probe before catalog fetch.
• 6b3e8a026: unproven 422 fails closed; cancellation is not converted into a success-shaped fallback.
• 58732f0bb: validation/catalog same-origin guard.
• 16defab54: this port has fixed HTTPS endpoints rather than configurable endpoint overrides.

Security invariants

• Browser cookie metadata is retained through every redirect. Only cookies scoped to https://ollama.com and the current request path are serialized; sibling-domain and path-scoped cookies never cross their scope.
• Cookie scope is recomputed after each same-origin redirect; a cookie that matched the initial path is not sent to a non-matching destination path, while destination-scoped cookies are sent.
• signin.ollama.com, WorkOS authorization, and all cross-origin redirects stop with AuthRequired before a credentialed follow-up.
• Manual headers require a recognized session name and attach only to HTTPS ollama.com.
• Shared credentialed redirects and Ollama API validation use the same origin comparator.
• Keys/cookies are never logged or included in errors.
• Only validation 200/400 proves a key; 401/403 are invalid/revoked, and other statuses fail before catalog fetch.

Already present / non-applicable

• Reuses Windows browser/DPAPI cookie APIs; no macOS Keychain/AppKit code was ported.
• Optional API-key Auto preserves the established browser-cookie fallback.
• Rust task/future cancellation is preserved: no catch or fallback remaps it.
• No frontend, locale, or settings UI change.

Validation

Initial RED/GREEN: focused Ollama tests failed before AuthKit, WorkOS redirect, authenticated validation, cookie scope, redirect-path scope, and exact NextAuth chunk behavior were added; then passed.

Follow-up RED/GREEN: focused tests were added for the canonical same-origin helper, per-hop cookie scope recomputation, mockito same-origin redirect flow, signin/WorkOS terminal redirects, and bounded redirect exhaustion before the redirect seam was extracted; core HTTP (4) and Ollama (17) focused tests passed.

Fresh full validation:

• cargo fmt --manifest-path rust/Cargo.toml --all -- --check
• cargo fmt --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml --all -- --check
• cargo test --manifest-path rust/Cargo.toml (544 passed)
• cargo test --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml (303 passed)
• cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warnings
• cargo clippy --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml --all-targets -- -D warnings
• git diff --check

Manual Windows validation with a real authenticated browser profile was not run, to avoid accessing user credentials; native tests cover cookie scope and request sequencing.