Desktop OIDC: open in system browser via window.open, revert to copy-paste

The local HTTP server approach (fetch to 127.0.0.1) doesn't work in the
Wails webview. Simplify: use window.open() to launch OIDC in the real
browser. After authentication, the callback page at the server shows the
token. User copies and pastes into the Token tab.

Also fix: SetSize before app.Run() crashes with nil pointer — use
WebviewWindowOptions width/height directly from restored state.

web/src/lib/oidc.ts

@@ -101,7 +101,14 @@ export async function startLogin(): Promise<void> {
     scope: 'openid profile email'
   })
 
-  location.href = `${cfg.authorization_endpoint.replace(/\/$/, '')}/?${params}`
+  const authURL = `${cfg.authorization_endpoint.replace(/\/$/, '')}/?${params}`
+
+  if (isDesktop) {
+    window.open(authURL, '_blank', 'width=800,height=700')
+    throw new Error('Login opened in your browser. After authenticating, copy the token and paste it into the Token tab.')
+  }
+
+  location.href = authURL
 }
 
 export async function handleCallback(code: string, returnedState: string): Promise<boolean> {

web/src/pages/Config.svelte

@@ -67,27 +67,7 @@
     error = ''
     oidcLoggingIn = true
     setConfig({ apiUrl: apiUrl.trim(), token: '' })
-
-    const isDesktop = new URLSearchParams(location.search).has('desktop')
-
-    if (isDesktop) {
-      try {
-        const resp = await fetch(`http://127.0.0.1:18901/oidc/login?apiUrl=${encodeURIComponent(apiUrl.trim())}`)
-        const data = await resp.json()
-        if (data.token) {
-          setConfig({ apiUrl: apiUrl.trim(), token: data.token })
-          initConfig({ apiUrl: apiUrl.trim(), token: data.token })
-          oidcLoggingIn = false
-          onConnected()
-          return
-        }
-        error = data.error || 'Login failed'
-      } catch (e: any) {
-        error = e.message || 'Could not reach OIDC service'
-      }
-      oidcLoggingIn = false
-      return
-    }
+    initConfig({ apiUrl: apiUrl.trim(), token: '' })
 
     try {
       await startLogin()