Expose OAuth and account providers in onboarding

The provider step was filtered to API_KEY only, which hid GitHub
Copilot, Google Antigravity, and GPT account from the founding-CEO
runtime picker even though they are first-class providers in the
catalog. Show every non-cloud provider, render an "Access token" field
in place of the API-key field for OAuth and account auths, and surface
a button that opens the provider's official sign-in page via the new
openExternalUrl IPC (validated to http(s) only).

OnboardingService.resolveProvider now accepts any non-cloud auth type.
Cloud providers still route through Settings since their multi-field
config does not fit the linear onboarding step.

AgentCompany-New/src/main/services/onboarding-service.ts

@@ -85,8 +85,8 @@ export class OnboardingService {
   private resolveProvider(providerKey: string) {
     const provider = PROVIDER_CATALOG.find((entry) => entry.key === providerKey);
     if (!provider) throw new Error(`Provider ${providerKey} is unavailable.`);
-    if (provider.authType !== PROVIDER_AUTH_TYPE.API_KEY) {
-      throw new Error("Onboarding requires an API key provider.");
+    if (provider.authType === PROVIDER_AUTH_TYPE.CLOUD) {
+      throw new Error("Cloud providers need extended configuration — connect them from Settings after the company is created.");
     }
     return provider;
   }