Bug: Grok Team OAuth fails after authorization

[redreceipt]

Issue details

Authorizing a Grok Team subscription completes the browser callback and authorization-code exchange, but Fx then fails with GrokUserInfoRequestFailed instead of producing a usable Grok session.

The failure occurs because Fx unconditionally retrieves the subscription account identity from /oauth2/userinfo. Team access tokens identify the selected subscription principal through principal_type and principal_id claims instead; that principal is not a personal userinfo identity. The refresh request also omits those Team principal fields, so it cannot preserve the selected Team principal.

Steps to reproduce:

1. Start fx login grok and choose the subscription login flow.
2. Authorize a Grok Team subscription in the browser.
3. Complete the callback.
4. Observe that Fx fails during the subsequent userinfo request with GrokUserInfoRequestFailed.

Expected behavior:

• Team authorization completes and the selected Team principal becomes the stored subscription identity.
• Refresh requests retain that same Team principal.
• Personal/User principals continue using the existing authenticated userinfo path and do not send Team principal fields during refresh.

The causal path was reproduced without including any OAuth payloads or account identifiers. A focused fix and end-to-end proof are in #456.

Sensitive information

• I reviewed the information above and removed secrets and other sensitive data.

[davidask]

Also encountered this, and should be considered a bug i believe.

[redreceipt]

I have linked PR I think fixes it