Desktop OIDC: non-blocking fetch + poll, don't leave webview

SPA fetches /oidc/open (returns session ID immediately), then polls
/oidc/result every 500ms. Go server opens browser in a goroutine.
Webview never leaves the Wails origin. Token is saved to keychain and
returned through the poll response.

web/src/lib/oidc.ts

@@ -102,9 +102,8 @@ export async function startLogin(): Promise<void> {
   })
 
   if (isDesktop) {
-    const apiUrl = getConfig().apiUrl || location.protocol + '//' + location.host
-    location.href = `http://127.0.0.1:18901/oidc/open?apiUrl=${encodeURIComponent(apiUrl)}`
-    throw new Error('Redirecting to login...')
+    const apiUrl = getConfig().apiUrl || ''
+    throw new Error('DESKTOP_OIDC:' + apiUrl)
   }
 
   location.href = `${cfg.authorization_endpoint.replace(/\/$/, '')}/?${params}`