Fix Parallel OAuth callback and browser handling

[anirudhmehra]

Summary

• capture the loopback callback origin while the listener is active
• build request URLs from that captured origin instead of calling server.address() per request
• force-close active callback connections so listener shutdown cannot block credential storage
• let Pi own browser opening so /login parallel opens one authorization tab instead of two
• add regression coverage for all three behaviors

Problems

Callback crash during shutdown

Node documents that server.address() returns null after server.close(). An already-active keep-alive connection can still dispatch a follow-up request, such as /favicon.ico, while the callback listener is closing. The request handler then dereferences address.port, causing an uncaught TypeError and terminating the host process before OAuth credentials are persisted.

The callback regression test uses a real socket to keep the callback request active, begins listener shutdown, then sends /favicon.ico on the same connection. It reproduces the original null.port stack without the fix.

Callback shutdown can block credential storage

server.close() waits for active HTTP connections before invoking its callback. Chrome can keep the loopback callback connection active after the token exchange has completed, leaving Pi's login dialog open indefinitely and preventing the fetched API key from reaching credential storage. Navigating to the authorization URL again happened to close the old connection, which made login appear to require a second click.

After calling server.close() to stop new connections, the listener now calls Node's native server.closeAllConnections(). The regression test keeps the callback request active and verifies login completes without any second browser action or client disconnect.

Duplicate authorization tabs in Pi

The shared OAuth helper opened the authorization URL directly, then Pi opened the notified auth_url again in LoginDialogComponent.showAuth(). The Pi adapter now passes openBrowser: false, making Pi the sole browser owner. OpenCode remains unchanged because it explicitly needs the helper to open its URL.

The shared callback helper is bundled into both the Pi extension and OpenCode plugin; the browser-opening change is Pi-specific.

Verification

• pnpm test:ci
• pnpm lint
• pnpm format:check
• pnpm typecheck
• pnpm build
• active-socket OAuth regression passed 5 consecutive runs