feat(FN-3047): add cancellable auth flow with recoverable pending login UX

This merge implements a recoverable pending-login auth flow (FN-3047) across three phases: cancellable in-progress auth routes in the API, an extended auth client contract, and updated ModelOnboardingModal/SettingsModal UI with proper cancel-button visibility during logout. It also adds `dashboard-r

Fusion-Task-Id: FN-3047

packages/dashboard/app/api/legacy.ts

@@ -1236,6 +1236,8 @@ export interface AuthProvider {
   id: string;
   name: string;
   authenticated: boolean;
+  /** True when the server currently has an active OAuth login flow for this provider. */
+  loginInProgress?: boolean;
   /**
    * How this provider authenticates / is activated.
    * - "oauth": OAuth flow (user clicks Login → redirect)
@@ -1653,6 +1655,14 @@ export function logoutProvider(provider: string): Promise<{ success: boolean }>
   });
 }
 
+/** Cancel an in-progress OAuth login attempt for a provider. */
+export function cancelProviderLogin(provider: string): Promise<{ success: boolean; cancelled: boolean }> {
+  return api<{ success: boolean; cancelled: boolean }>("/auth/cancel", {
+    method: "POST",
+    body: JSON.stringify({ provider }),
+  });
+}
+
 /** Save an API key for an API-key-backed provider. */
 export function saveApiKey(provider: string, apiKey: string): Promise<{ success: boolean }> {
   return api<{ success: boolean }>("/auth/api-key", {