Desktop OIDC: redirect webview to local server, Go opens browser

The webview navigates to http://127.0.0.1:18901/oidc/open?apiUrl=...
The Go server opens the system browser to Authentik, waits for callback,
exchanges code for token, saves to keychain, then redirects the webview
back with ?desktop=1&token=TOKEN. main.ts extracts the token from URL.

web/src/lib/oidc.ts

@@ -101,14 +101,13 @@ export async function startLogin(): Promise<void> {
     scope: 'openid profile email'
   })
 
-  const authURL = `${cfg.authorization_endpoint.replace(/\/$/, '')}/?${params}`
-
   if (isDesktop) {
-    window.open(authURL, '_blank', 'width=800,height=700')
-    throw new Error('Login opened in your browser. After authenticating, copy the token and paste it into the Token tab.')
+    const apiUrl = getConfig().apiUrl || location.protocol + '//' + location.host
+    location.href = `http://127.0.0.1:18901/oidc/open?apiUrl=${encodeURIComponent(apiUrl)}`
+    throw new Error('Redirecting to login...')
   }
 
-  location.href = authURL
+  location.href = `${cfg.authorization_endpoint.replace(/\/$/, '')}/?${params}`
 }
 
 export async function handleCallback(code: string, returnedState: string): Promise<boolean> {