The Wails runtime isn't reliably loading for IPC calls. Replace the binding-based StartOIDCLogin with a local HTTP server on 127.0.0.1:18901: - /oidc/login?apiUrl=... — opens system browser, waits for token - /oidc/callback — Authentik redirect target, exchanges code - /oidc/config?apiUrl=... — fetches OIDC provider config - SPA detects desktop via ?desktop=1 URL param - SPA calls localhost directly via fetch() instead of Wails IPC