fix: restore Anthropic subscription card after in-session logout + re-login

Subscription OAuth is aliased across the legacy `anthropic` id (where login
persists the credential) and `anthropic-subscription` (where the settings card
and status read are keyed). After an in-session logout, re-login wrote only
`anthropic` and never cleared the in-memory `anthropic-subscription` logged-out
flag, so the card reported "Login did not complete" despite a valid stored
credential until the process restarted.

auth-storage's proxy now clears the logged-out suppression on both aliases when
either is re-authenticated (new `login` trap + hardened `set` trap via
clearReauthenticatedLogoutState); raw api_key writes stay scoped to their own
card. Also surface previously-swallowed background OAuth login failures on
GET /auth/status (`loginError`) plus server logs and a settings toast, so real
paste-callback failures are diagnosable instead of a generic error.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/dashboard/app/api/legacy.ts

@@ -1773,6 +1773,15 @@ export interface AuthProvider {
   expired?: boolean;
   /** True when the redirect cannot reach this dashboard host and the user must paste the URL/code back manually. */
   requiresManualCode?: boolean;
+  /**
+   * Reason the most recent background OAuth login attempt failed, if any.
+   * Interactive logins resolve the auth URL immediately and finish in the
+   * background; when that background flow rejects (bad/expired code, token
+   * exchange rejection, redirect_uri mismatch) this carries the cause so the
+   * UI can show why login failed instead of a generic error. Cleared when a
+   * fresh login for the provider starts.
+   */
+  loginError?: string;
   /**
    * How this provider authenticates / is activated.
    * - "oauth": OAuth flow (user clicks Login → redirect)