Fix abandoned browser OAuth leaving onboarding stuck

[fabianxagent]

Summary

This fixes onboarding getting stuck when a browser-based OAuth flow is started but never completed, with ChatGPT subscription auth as the reproducible case.

The root cause was that the Electron flow waited indefinitely for the browser callback and did not expose a real cancel path back into the pending OAuth state.

Changes

• add a shared timeout for pending ChatGPT OAuth flows and reuse it on both the preload and server sides
• make the Electron callback wait cancellable and timeout-aware instead of waiting forever
• wire ChatGPT cancellation through preload so the renderer can abort an in-flight OAuth attempt and clean up server state
• prevent late OAuth completions from overwriting a user-initiated cancel in onboarding state
• show Cancel while provider-managed OAuth is pending, so the user is not left with a disabled Back button
• keep the pending/cancel onboarding behavior consistent for the shared provider-managed OAuth paths
• add targeted tests for the timeout/cancel wait helper and onboarding OAuth cancellation dispatch

Testing

• bun test apps/electron/src/preload/oauth-wait.test.ts apps/electron/src/renderer/hooks/__tests__/oauth-cancel.test.ts apps/electron/src/renderer/hooks/__tests__/useOnboarding.test.ts
• cd apps/electron && bun run typecheck
• cd packages/server-core && bun run typecheck
• bun run electron:build:preload
• bun run electron:build:renderer
• bun run typecheck:all currently fails on existing repository baseline issues unrelated to this change, including a missing tsconfig.base.json, external @types/cacheable-request / keyv type issues, and unrelated packages/session-tools-core errors

Screenshots

UI change: while external OAuth is pending, the disabled Back action is replaced with an explicit Cancel action to let the user abandon the flow cleanly.