Qualify provider auth through real web card callbacks

[piclaw-bot]

Real callback/public-runtime provider-auth browser matrix

Refs #1458 and #1442; both stay open. Offline qualification continues without target/scope waivers.

Add a disposable Chromium/WebKit fixture using the actual DB-backed WebAdaptiveCardSidePromptService, login handler and public ModelRuntime/FileCredentialStore with a typed faux provider. The TestSession supplies bookkeeping only.

• Exercise picker and explicit OAuth-method choice, private select/device/progress/manual/secret/text prompts, stored completion and explicit model activation.
• Cover denial/retry, cancel, expiry and close/reopen continuity. Cancel/expiry verify backend provider signal abort and stale callback409 before cleanup.
• Record every message write; check all rows, broadcasts and captured logs for provider-event and submitted-secret sentinels.
• Clean resources on setup/launch/assertion failure; browser requests restricted to the disposable origin and execution uses an empty account environment.

Scope is fresh-source browser fixture with real service/public runtime, not packed CLI/web artifact, production HTTP authentication middleware, real-provider device polling or approved live account acceptance. No inference/deployment/restart/native-MCP activation.

Validation

Chromium/WebKit: 8 pass / 80 assertions. Five standard types, strict server-fixture typing using existing dependency declarations, scoped lint and diff pass. Independent review corrections applied and final scoped review found no blocker. Browser module built from current renderer/dialog. Frozen canonical gate: 5,970 passed, eight existing/opt-in skips, zero failed; 25 feature and nine web checks passed. Browser files are excluded there and separately executed at8/80. Pack hygiene: 24,742 files. Final five types/diff passed at baseline b50df2771; unchanged compose baseline. Private Bun cache, no shared-cache permission changes. Env observation snapshot has only documentation references to existing opt-in flags.