Fix OIDC login in desktop: sync apiUrl before startLogin, add app icon

- Config.svelte: call setConfig() before startLogin() so fetchConfig
  uses the user-entered server URL
- Makefile: copy icon.icns into .app bundle Resources
- Info.plist: add CFBundleIconFile entry

Makefile

@@ -66,6 +66,7 @@ desktop-package: desktop   ## Build + package the desktop app (zip on macOS, tar
 			mkdir -p "$$APP/Contents/MacOS"; \
 			mkdir -p "$$APP/Contents/Resources"; \
 			cp cmd/desktop/build/bin/oikos-desktop "$$APP/Contents/MacOS/oikos-desktop"; \
+			cp cmd/desktop/icon.icns "$$APP/Contents/Resources/icon.icns"; \
 			sed 's/$$(VERSION)/0.1.0/' cmd/desktop/Info.plist.template > "$$APP/Contents/Info.plist"; \
 			cd cmd/desktop/build/bin && zip -r oikos-desktop-darwin-$$(uname -m).zip oikos-desktop.app ;; \
 		Linux) \

cmd/desktop/Info.plist.template

@@ -8,6 +8,8 @@
 	<string>oikos-desktop</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.hubris.oikos-desktop</string>
+	<key>CFBundleIconFile</key>
+	<string>icon</string>
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
 	<key>CFBundleName</key>

web/src/pages/Config.svelte

@@ -66,6 +66,7 @@
   async function loginWithAuthentik() {
     error = ''
     oidcLoggingIn = true
+    setConfig({ apiUrl: apiUrl.trim(), token: '' })
     try {
       await startLogin()
     } catch (e: any) {