Replace one-secret provider dialog with per-auth-type fields

OAuth, account, and cloud providers previously fell into the same
password input as API key providers, which made them impossible to
connect properly. Split the connect dialog by auth type:

- api_key: secret + model (unchanged)
- oauth_pkce / account_subscription: button that opens the provider's
  official sign-in URL in a session-partitioned BrowserWindow, then a
  paste field for the access token returned by the provider
- cloud: multi-field form (base URL, region, project, deployment,
  credential) serialized into the encrypted secret payload

Each catalog entry now carries signInUrl and credentialHelp so the
dialog can render the right instructions without baking copy into the
renderer.

Backed by a new launchProviderSignIn IPC method on ProviderService that
opens a hardened popup (nodeIntegration off, contextIsolation on,
sandbox on, permission denies) and records an audit event.

AgentCompany-New/src/shared/commands.ts

@@ -110,6 +110,11 @@ export interface SaveProviderCredentialInput {
   model: string | null;
 }
 
+export interface LaunchProviderSignInInput {
+  orgId: string;
+  providerId: string;
+}
+
 export interface CreateProviderResponseInput {
   orgId: string;
   providerId: string;

AgentCompany-New/src/shared/desktop-api.ts

@@ -18,6 +18,7 @@ import type {
   DeleteOrganizationInput,
   ImportFileInput,
   ImportSkillDirectoryInput,
+  LaunchProviderSignInInput,
   LaunchSocialLoginInput,
   ResolveAgentSkillsInput,
   SaveProviderCredentialInput,
@@ -47,6 +48,7 @@ export interface DesktopApi {
   sendMessage(input: SendMessageInput): Promise<DesktopResult<AppSnapshot>>;
   markChatSpaceRead(input: MarkChatSpaceReadInput): Promise<DesktopResult<AppSnapshot>>;
   saveProviderCredential(input: SaveProviderCredentialInput): Promise<DesktopResult<AppSnapshot>>;
+  launchProviderSignIn(input: LaunchProviderSignInInput): Promise<DesktopResult<null>>;
   createProviderResponse(input: CreateProviderResponseInput): Promise<DesktopResult<AppSnapshot>>;
   importSkillDirectory(input: ImportSkillDirectoryInput): Promise<DesktopResult<AppSnapshot>>;
   bindSkill(input: BindSkillInput): Promise<DesktopResult<AppSnapshot>>;

AgentCompany-New/src/shared/domain.ts

@@ -279,6 +279,8 @@ export interface ProviderCatalogEntry {
   authType: ProviderAuthType;
   defaultModel: string | null;
   capabilityTags: string[];
+  signInUrl: string | null;
+  credentialHelp: string;
 }
 
 export interface ProviderRequestRecord {

AgentCompany-New/src/shared/ipc.ts

@@ -13,6 +13,7 @@ export const IPC_CHANNELS = {
   sendMessage: "agentcompany:send-message",
   markChatSpaceRead: "agentcompany:mark-chat-space-read",
   saveProviderCredential: "agentcompany:save-provider-credential",
+  launchProviderSignIn: "agentcompany:launch-provider-sign-in",
   createProviderResponse: "agentcompany:create-provider-response",
   importSkillDirectory: "agentcompany:import-skill-directory",
   bindSkill: "agentcompany:bind-skill",

AgentCompany-New/src/shared/provider-catalog.ts

@@ -7,6 +7,8 @@ export const PROVIDER_CATALOG: ProviderCatalogEntry[] = [
     authType: PROVIDER_AUTH_TYPE.API_KEY,
     defaultModel: "gpt-5.1",
     capabilityTags: ["responses", "tools", "background"],
+    signInUrl: null,
+    credentialHelp: "Generate an API key at platform.openai.com → API keys.",
   },
   {
     key: "anthropic",
@@ -14,6 +16,8 @@ export const PROVIDER_CATALOG: ProviderCatalogEntry[] = [
     authType: PROVIDER_AUTH_TYPE.API_KEY,
     defaultModel: "claude-sonnet-4-5",
     capabilityTags: ["messages", "tool-use", "token-bucket"],
+    signInUrl: null,
+    credentialHelp: "Generate an API key at console.anthropic.com → API keys.",
   },
   {
     key: "xai",
@@ -21,54 +25,70 @@ export const PROVIDER_CATALOG: ProviderCatalogEntry[] = [
     authType: PROVIDER_AUTH_TYPE.API_KEY,
     defaultModel: "grok-4",
     capabilityTags: ["chat", "reasoning"],
-  },
-  {
-    key: "github-copilot",
-    label: "GitHub Copilot",
-    authType: PROVIDER_AUTH_TYPE.OAUTH_PKCE,
-    defaultModel: null,
-    capabilityTags: ["account", "coding"],
-  },
-  {
-    key: "google-antigravity",
-    label: "Google Antigravity",
-    authType: PROVIDER_AUTH_TYPE.OAUTH_PKCE,
-    defaultModel: null,
-    capabilityTags: ["account", "coding"],
-  },
-  {
-    key: "gpt-account",
-    label: "GPT account",
-    authType: PROVIDER_AUTH_TYPE.ACCOUNT_SUBSCRIPTION,
-    defaultModel: null,
-    capabilityTags: ["codex", "subscription"],
-  },
-  {
-    key: "azure-openai",
-    label: "Azure OpenAI",
-    authType: PROVIDER_AUTH_TYPE.CLOUD,
-    defaultModel: null,
-    capabilityTags: ["enterprise", "regional"],
-  },
-  {
-    key: "aws-bedrock",
-    label: "AWS Bedrock",
-    authType: PROVIDER_AUTH_TYPE.CLOUD,
-    defaultModel: null,
-    capabilityTags: ["enterprise", "multi-model"],
-  },
-  {
-    key: "vertex-ai",
-    label: "Vertex AI",
-    authType: PROVIDER_AUTH_TYPE.CLOUD,
-    defaultModel: null,
-    capabilityTags: ["enterprise", "regional"],
+    signInUrl: null,
+    credentialHelp: "Generate an API key at console.x.ai → API keys.",
   },
   {
     key: "groq",
     label: "Groq",
     authType: PROVIDER_AUTH_TYPE.API_KEY,
-    defaultModel: null,
+    defaultModel: "groq/compound",
     capabilityTags: ["inference", "low-latency"],
+    signInUrl: null,
+    credentialHelp: "Generate an API key at console.groq.com → API keys.",
+  },
+  {
+    key: "github-copilot",
+    label: "GitHub Copilot",
+    authType: PROVIDER_AUTH_TYPE.OAUTH_PKCE,
+    defaultModel: "claude-opus-4-5",
+    capabilityTags: ["account", "coding"],
+    signInUrl: "https://github.com/login",
+    credentialHelp: "Sign in, then copy the personal access token (scope copilot) from github.com → Settings → Developer settings.",
+  },
+  {
+    key: "google-antigravity",
+    label: "Google Antigravity",
+    authType: PROVIDER_AUTH_TYPE.OAUTH_PKCE,
+    defaultModel: "claude-sonnet-4-5",
+    capabilityTags: ["account", "coding"],
+    signInUrl: "https://antigravity.google/",
+    credentialHelp: "Sign in to Antigravity, then paste the session token shown in the dashboard.",
+  },
+  {
+    key: "gpt-account",
+    label: "GPT account",
+    authType: PROVIDER_AUTH_TYPE.ACCOUNT_SUBSCRIPTION,
+    defaultModel: "gpt-5.3-codex",
+    capabilityTags: ["codex", "subscription"],
+    signInUrl: "https://chatgpt.com/codex",
+    credentialHelp: "Sign in to ChatGPT Plus/Pro, then paste the session access token from chatgpt.com/codex/settings.",
+  },
+  {
+    key: "azure-openai",
+    label: "Azure OpenAI",
+    authType: PROVIDER_AUTH_TYPE.CLOUD,
+    defaultModel: "gpt-5.4",
+    capabilityTags: ["enterprise", "regional"],
+    signInUrl: null,
+    credentialHelp: "Set base URL (e.g. https://<resource>.openai.azure.com), deployment name, and the api-key from Azure portal.",
+  },
+  {
+    key: "aws-bedrock",
+    label: "AWS Bedrock",
+    authType: PROVIDER_AUTH_TYPE.CLOUD,
+    defaultModel: "anthropic.claude-sonnet-4-5",
+    capabilityTags: ["enterprise", "multi-model"],
+    signInUrl: null,
+    credentialHelp: "Provide AWS region plus an access key + secret access key with bedrock:InvokeModel permission.",
+  },
+  {
+    key: "vertex-ai",
+    label: "Vertex AI",
+    authType: PROVIDER_AUTH_TYPE.CLOUD,
+    defaultModel: "gemini-2.5-pro",
+    capabilityTags: ["enterprise", "regional"],
+    signInUrl: null,
+    credentialHelp: "Provide GCP project id, region, and a service-account JSON key with aiplatform.user role.",
   },
 ];