fix(models, oauth): placeholder-key suppression, subscription badge, 401 hint, OAuth flow timeout

[bjb2]

Closes #4 and #5.

Two related bug reports from the same demo session, both tied to provider/auth confusion. Bundled in one PR because the second fix (#5) was discovered while reviewing the surface area for #4.

---

#4 — gpt-5 routes through API key instead of ChatGPT Plus subscription

A viewer with a ChatGPT Plus subscription tried to send a prompt during a live demo. They picked gpt-5 in the model picker. OpenAI rejected the call with:

401 Incorrect API key provided: sk-your-****************here

sk-your-...here is a common .env.example placeholder. The viewer had it lying around in their env (typical tutorial leftover). The SDK saw a non-empty OPENAI_API_KEY, marked the openai-provider variant of gpt-5 as available, and that beat their actual openai-codex (ChatGPT Plus OAuth) subscription credential in the picker because nothing in the UI distinguished the two.

Root cause: SDK ships overlapping model namespaces. Same gpt-5 exists under openai (API key) AND openai-codex (subscription). hasConfiguredAuth only checks "env var non-empty"; UI didn't distinguish providers.

Fixes:

• A. Placeholder-key suppression (apps/server/src/credential-quality.ts): looksLikePlaceholderKey matches sk-your-*, sk-XXXX, your-api-key, <your-key>, changeme, unsubstituted shell vars, all-X strings, and per-prefix-family length floors. Wired into modelInfoFromSdk. OAuth credentials in auth.db bypass the check.
• B. Subscription badge (ModelPickerModal.tsx + ModelInfo.isSubscription): green subscription badge on rows for real consumer-subscription providers. Uses an explicit allowlist (anthropic, openai-codex, github-copilot, cursor, perplexity, coding-plan providers, etc.) — not the SDK's broader getOAuthProviders() which would have falsely badged Ollama, LM Studio, and gateway services.
• C. 401-recovery hint: bridge listens for SDK notice events with auth-shaped error messages; when current model is API-key and a subscription provider carries the same model id with a real OAuth credential, fires a deck notificationService.notify telling the operator to switch.

---

#5 — OAuth flow gets stuck "already in progress" forever

User closed the Ollama OAuth modal without typing in an endpoint URL. Subsequent attempts to sign in to Ollama returned 409 {"error":"already-in-flight"} until the deck process was restarted.

Root cause: Ollama's OAuth flow uses onPrompt to ask for the local endpoint URL — not the loopback callback listener that the SDK's DEFAULT_TIMEOUT (5 min) covers. Closing the modal without responding leaves the SDK's login promise pending forever, the flow stays in the flows map, and every subsequent /start 409s.

The pre-fix cancel handler was also incomplete — only rejected manualCode, never iterated promptResolvers. So even hitting Cancel wouldn't have unstuck this case.

Fixes (in apps/server/src/routes-auth-oauth.ts):

1. 5-min server-side timeout per flow. Force-cancels if not naturally completed. Cleared on natural completion.
2. Stale-flow eviction on /start. If a duplicate start arrives and the held flow is past 5 min, evict it inline (defensive belt-and-suspenders if the timer somehow lost).
3. abortFlow helper that drains promptResolvers too (resolves with empty string — rejecting would surface as uncaught inside the SDK). Used by all three teardown paths (cancel, timeout, stale eviction). Idempotent.

---

Verification

• 12 new tests: 6 for looksLikePlaceholderKey (44 assertions), 6 for abortFlow cleanup (9 assertions)
• Full server suite: 173 / 173 pass (was 161 before this PR)
• Typecheck across all 4 packages: clean
• Manual sanity: OPENAI_API_KEY=sk-your-XXXXhere correctly hides openai/gpt-5 from default picker view while leaving openai-codex/gpt-5 visible with the subscription badge

Files touched

apps/server/src/credential-quality.ts            (new — #4)
apps/server/src/credential-quality.test.ts       (new — #4)
apps/server/src/bridge/in-process.ts             (#4: placeholder + badge + 401 hint)
apps/server/src/routes-auth-oauth.ts             (#5: timeout + eviction + cleanup)
apps/server/src/routes-auth-oauth.test.ts        (new — #5)
apps/web/src/components/chat/ModelPickerModal.tsx (#4: subscription badge)
packages/protocol/src/index.ts                   (#4: +isSubscription)

Out of scope

• SDK upstream change to dedupe overlapping model namespaces (would need a pi-ai change)
• Auto-switching model on 401 (notification-only for now; mid-turn auto-switch risks surprise behavior)
• Settings → Env input validation (validate-on-paste for placeholder values — separate UX work)
• Per-flow timeout tuning UI (5 min hardcoded; if users hit this regularly we can expose a knob)