Add OAuth login and logout controls to the dashboard

[m-aebrer]

Summary

Add dashboard-native OAuth provider login and logout workflows. The built-in /login and /logout commands are valid dashboard commands, but will temporarily show a not-yet-implemented notice until this work lands.

Current Behavior

• OAuth login and logout are available only through the terminal UI.
• The dashboard has no provider selector or authentication workflow.
• /login and /logout can be discovered and intercepted by the built-in-command work, but cannot perform their actions.

Proposed Behavior

• /login opens a dashboard provider selector and starts the selected provider's OAuth flow.
• /logout lists authenticated providers and allows the user to remove credentials after confirmation.
• Browser links, manual codes, provider prompts, progress, cancellation, and errors are presented in dashboard UI.
• Credentials and tokens remain in the agent process and are never returned to the browser.
• Slash commands and any future dashboard buttons use the same underlying actions.

Acceptance Criteria

• /login opens the OAuth provider selection workflow.
• OAuth URLs are presented as clickable links.
• Manual-code, prompted-input, and polling-based providers are supported.
• Login can be cancelled without leaving an unresolved operation.
• Successful login persists credentials using existing auth storage.
• /logout lists authenticated providers and removes the selected credential after confirmation.
• Tokens and secrets are never included in dashboard API responses or browser state.
• Provider failures are shown explicitly.
• Model/authentication state refreshes after login or logout.
• Tests cover success, cancellation, input prompts, logout, and errors.
• Dashboard and RPC documentation are updated.

Context

• Built-in dashboard command work: Dashboard: intercept built-in slash commands instead of passing them to the LLM #425
• Related scoped-model dashboard work: Add scoped-model configuration to dashboard settings #404

Technical Notes

Reuse the existing OAuth provider and auth-storage abstractions. Keep provider credentials inside the agent process; dashboard APIs should expose only provider metadata, user-facing prompts, progress, and completion status.