feat(desktop): route standard API key onboarding through Runtime Host

[me2seeks]

Summary

• route fixed-endpoint, standard API-key onboarding through the existing Runtime Host verify/save operations
• let users verify credentials, choose enabled models, and adopt the exact Host-returned connection identity
• preserve advanced/custom Desktop onboarding as an explicit legacy path with no fallback after a Host failure
• keep an outcome-unknown safety lease across Settings remounts so duplicate creation requires explicit acknowledgement

Part of #3852.

Before / after

Before, Desktop allocated the slug and assembled catalog, credential, and model updates through its legacy multi-step create path. The common API-key form saved immediately and did not let the user choose initial enabled models.

After, the common fixed-endpoint path is: enter API key → Runtime Host verifies and returns models → choose enabled models → Runtime Host atomically saves and returns canonical connectionId + slug → Desktop opens that exact connection.

Cloudflare, custom endpoints, request headers, and request-body overlays remain on the existing advanced path.

Failure semantics

• save-time authentication failure returns to the API-key input with the key preserved
• committed save plus refresh failure remains success and shows the canonical slug
• commit_outcome_unknown or dispatched interruption never retries or falls back; the list remains inspectable and every Add entry point stays locked until explicit restart
• attempt leases prevent a late old save from clearing a newer attempt safety gate

Protocol scope

Uses existing connection.onboarding.verify and connection.onboarding.save operations. No Runtime Host wire operation, storage schema, or compatibility epoch change. Durable reconciliation across a Desktop process restart remains follow-up journal/epoch work in #3852.

Visual evidence

Standard API-key flow

Enter credential	Choose initial models

Outcome-unknown safety

The connection list stays inspectable while the normal Add entry point is locked, preventing an accidental duplicate save.

Real Desktop session

Built this PR, opened the existing real Desktop profile through the real Runtime Host, created a new task using the existing OpenCode Free connection and Nemotron 3 Ultra Free model, and received the exact response PR4377 session OK. This verifies the post-catalog model-choice → session → provider execution path with a real configured connection; the fresh-key onboarding states above remain deterministic Storybook evidence so no credential is exposed.

Validation

• npm ci
• Desktop workspace dependency build, full typecheck, and main build
• renderer architecture: 60 tests
• focused onboarding/IPC: 28 tests
• Storybook static build
• Storybook interactions: input, model selection, back invalidation, exact deepseek-2 adoption, refresh warning, outcome unknown with non-empty/empty catalogs, detail round-trip lock, and save-time auth failure
• real Desktop profile: Runtime Host became ready with the 120 s diagnostic deadline, a new OpenCode Free / Nemotron 3 Ultra Free session completed, and the expected response was rendered

[M4n5ter]

Reviewed exact head 4cbf06af6ae943835eba7f111400f2f91311e42f. I found no blocking or non-blocking issues.

The two concerns from the previous head are closed: save-outcome uncertainty now remains observable across a Settings or Host-generation remount and settles the replacement UI automatically, while unclassified response/protocol failures after dispatch now fail closed as outcome_unknown instead of being treated as safe to retry.

I also verified the rebased model-catalog path. The selected Runtime Host remains the sole writer and authoritative model source: save performs fresh discovery, Storage validates the selected model IDs against that exact inventory, and Desktop adopts the exact identity returned by the Host. Fixed-endpoint API-key onboarding and the advanced/custom legacy path remain mutually exclusive before mutation, with no fallback after a failed or ambiguous Host save.

Verification on this head included the complete hosted CI job; 37 focused onboarding/main-process tests; 61 renderer architecture fixtures plus the live ledger check; full Desktop typechecking; Storybook production build; and 251 Storybook render/interaction smoke cases. The current-main merge tree is clean.

---

Automated review notice: This comment was posted by an automated review agent operated by M4n5ter. It is not an independent human review and does not replace one.