Handle OAuth denial and deduplicate login output

[rgarcia]

Summary

OAuth consent denial returns error=access_denied without a code. The CLI previously treated that valid error response as a malformed success callback, showing “missing authorization code” in the browser. Native login also emitted duplicate terminal statuses and reported success before credentials were persisted.

• Handle OAuth errors after state validation and before requiring a code. Denial returns a distinct error without entering token exchange.
• Reuse the callback page layout for a clear branded denial page without a success checkmark. Provider-supplied error descriptions are not reflected.
• Stop and erase the waiting spinner without printing a second status. The root renderer now emits the single meaningful denial, cancellation, or authentication error with a nonzero exit.
• Classify cancellation from the authentication error itself so a racing context cancellation cannot mask an unrelated failure.
• Print one success only after credentials are saved. Credential-save failures retain the storage error and reauthentication guidance and now exit nonzero.
• Preserve existing stored credentials on denial.
• Extract the callback and root error handlers for focused rendered-output regression coverage.

Validation

• go test ./pkg/auth ./cmd -count=1
• go test -race ./pkg/auth -count=1
• go vet ./pkg/auth ./cmd
• go build ./...
• Focused output tests cover success, consent denial, generic authentication failure, cancellation races, credential-save failure, and the real spinner erase boundary.
• Earlier built-binary loopback fixture: simulated browser launch and denial callback produced one clear terminal error, exit code 1, zero token requests, and unchanged fixture credentials. This used isolated fixture configuration with keyring access disabled, not a live provider login.
• Chromium rendering at desktop and mobile widths: denial text, embedded favicon, no success checkmark, and no horizontal overflow. Existing callback layout and colors are retained.
• Build, test, Semgrep, Socket Security, and BugBot checks pass on d99e4da9b708e119211d76dec6e5047305d8858f.

Released as v0.39.1 from merge commit 76daab28eabfc97bdb729d3fa579d9e2bbe99ecb. A live provider denial retest is still pending; the loopback fixture above was local only.

[cursor]

Stale Bugbot comment from a previous run.

[masnwilliams]

approved. this is a focused improvement: OAuth denial is handled after state validation, terminal output now has one owner, success is reported only after credentials are persisted, and the new failure paths have solid coverage. the callback refactor also leaves the files easier to navigate.

left two non-blocking follow-ups around cancellation classification and coverage of the real spinner behavior.

[rgarcia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d99e4da. Configure here.}