Expose OAuth and account providers in onboarding

The provider step was filtered to API_KEY only, which hid GitHub
Copilot, Google Antigravity, and GPT account from the founding-CEO
runtime picker even though they are first-class providers in the
catalog. Show every non-cloud provider, render an "Access token" field
in place of the API-key field for OAuth and account auths, and surface
a button that opens the provider's official sign-in page via the new
openExternalUrl IPC (validated to http(s) only).

OnboardingService.resolveProvider now accepts any non-cloud auth type.
Cloud providers still route through Settings since their multi-field
config does not fit the linear onboarding step.

AgentCompany-New/src/main/app/ipc-handlers.ts

@@ -1,4 +1,4 @@
-import { ipcMain, type BrowserWindow } from "electron";
+import { ipcMain, shell, type BrowserWindow } from "electron";
 import type { DatabaseConnection } from "../database/connection";
 import { IPC_CHANNELS } from "../../shared/ipc";
 import { fail, ok, type DesktopResult } from "../../shared/result";
@@ -86,6 +86,18 @@ export function registerIpcHandlers(deps: IpcDeps): void {
       return fail("provider_sign_in_failed", error instanceof Error ? error.message : String(error));
     }
   });
+  ipcMain.handle(IPC_CHANNELS.openExternalUrl, async (_event, url: string) => {
+    try {
+      const parsed = new URL(url);
+      if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        return fail("external_url_blocked", "Only http(s) URLs may be opened externally.");
+      }
+      await shell.openExternal(parsed.toString());
+      return ok(null);
+    } catch (error) {
+      return fail("external_url_failed", error instanceof Error ? error.message : String(error));
+    }
+  });
   ipcMain.handle(IPC_CHANNELS.createProviderResponse, async (_event, input) => {
     try {
       await providers.createResponse(input);

AgentCompany-New/src/main/services/onboarding-service.ts

@@ -85,8 +85,8 @@ export class OnboardingService {
   private resolveProvider(providerKey: string) {
     const provider = PROVIDER_CATALOG.find((entry) => entry.key === providerKey);
     if (!provider) throw new Error(`Provider ${providerKey} is unavailable.`);
-    if (provider.authType !== PROVIDER_AUTH_TYPE.API_KEY) {
-      throw new Error("Onboarding requires an API key provider.");
+    if (provider.authType === PROVIDER_AUTH_TYPE.CLOUD) {
+      throw new Error("Cloud providers need extended configuration — connect them from Settings after the company is created.");
     }
     return provider;
   }