fix(desktop): unblock Windows plan sign-in and space provider buttons

[davidmckayv]

What this changes

Fix Windows subscription sign-in and provider-button spacing:

• Find modern system-wide Podman installs in %ProgramFiles%\Podman. Install Podman when Docker's CLI exists but its engine is stopped; preserve responding Docker.
• Publish OpenAI's callback on IPv4 only for Windows Podman. The IPv6 forward accepted TCP but closed HTTP, preventing localhost from falling back to working IPv4. The registered OAuth redirect is unchanged.
• Answer the Windows ConPTY cursor query and retain the console through Claude's code exchange. Recognize the returned token even when terminal cursor formatting joins it to its label.
• Keep provider and saved-sign-in buttons separated when they wrap.

Fixes FOR-308

Where it runs

Desktop engine setup, plan sign-in, and provider UI. The callback remains loopback-only. No new server state, listener, port, schedule, or replica behavior.

Boundary and audit

Existing gateway identity, authorization, audit, and provider token exchanges are unchanged. Temporary diagnostic instrumentation is not shipped.

Changelog

No server changelog entry: these changes repair local desktop setup, authentication transport, and layout.

Proof

Actual non-admin Windows app, both subscriptions, no model API keys:

• OpenAI: browser approval returned through the callback; app signed in, started, and answered. The runtime had ChatGPT credentials and neither model API key. The selected LangGraph agent opened example.com and rendered a Jan/Feb/Mar line chart. Browser and chart screenshots were visually inspected and matched persisted tool results.
• Anthropic: browser approval → pasted one-time code → app signed in → Claude Agent SDK started and answered. The final installer ran with the Claude subscription token, neither model API key, and no ChatGPT credentials. The agent opened example.com; its actual browser screenshot shows the page heading and body. A real showLineChart call rendered Jan=120, Feb=180, Mar=240. Claude initially claimed the chart without calling the tool; one explicit follow-up produced the verified chart. That first reply was not counted as a pass.
• Both providers' browser and chart screenshots are attached to FOR-308. Mac's previously accepted sign-in was not repeated.

Regression checks: native Windows engine fixtures and callback/ConPTY/token regressions failed before their fixes and passed afterward. The full Windows code exchange passes all 20 focused plan tests. The final NSIS installer built successfully. Earlier affected-suite checks passed: 588 Rust tests, 96 desktop tests, formatting, Clippy, lint, typecheck, and frontend build. Provider layouts were visually checked at 900px and 375px.

Final-head CI: bc07ae83 — 18 passed, 3 skipped; Windows, macOS, and Linux checks green. Working tree and diff hygiene clean.

[linear-code]

FOR-308