feat(core): add Vercel AI Gateway setup and key replacement - #1

Issue for this PR

No linked issue. Adds guided Vercel AI Gateway setup and key replacement.

Type of change

• New feature
• Bug fix
• Documentation
• Refactor / code improvement

What does this PR do?

Vercel setup currently requires a pasted API key. This adds browser sign-in, team selection, key naming and expiration, and confirmation before creating an AI Gateway key. The app, TUI, and CLI share the setup prompts. Manual key entry remains available; setting a spending limit is an optional Vercel dashboard link after connecting.

Expired or rejected keys offer Replace key. Replacement preserves the existing connection's ID, name, active-account selection, and model preferences. Cancellation leaves the old key intact. Setup retries reconcile the server's current step, duplicate form submissions are blocked, and dismissed TUI flows ignore late responses. Vercel OAuth tokens are not persisted.

The OAuth client ID is the placeholder REPLACE_ME; no borrowed client ID is included. Set OPENCODE_VERCEL_CLIENT_ID on the server, or replace the placeholder with an OpenCode-owned public OAuth client before release. That app needs Team read access, AI Gateway API-key write access, and confirmed device-authorization support from Vercel. API permissions are currently documented as private beta.

How did you verify your code works?

• bun run check passed (full repository lint and typechecking); regenerated the client for the integration API changes.
• 37 focused core tests passed. Six app component tests passed ten repetitions (60 runs); 14 TUI tests passed ten repetitions (140 runs). Regression cases fail against the original implementation.
• The live sign-in/key-creation flow and model availability were verified in the macOS desktop development app before the test client ID was replaced with REPLACE_ME. The full backend also exposed 261 Vercel chat models after saving a test credential in an isolated local server.
• Replacement preserves connection identity/preferences in tests; live key expiration and replacement were not exercised.

Visual

<svg xmlns="http://www.w3.org/2000/svg" width="240" height="72" viewBox="0 0 240 72">
  <style>@media(prefers-reduced-motion:no-preference){.key{animation:fade 3s infinite}.done{animation:glow 3s infinite}}@keyframes fade{0%,100%{opacity:1}50%{opacity:.35}}@keyframes glow{0%,100%{opacity:.4}50%{opacity:1}}</style>
  <g fill="none" stroke="currentColor" stroke-width="1.5"><rect x="4" y="14" width="62" height="44" rx="7"/><path d="M76 36h24m-6-6 6 6-6 6"/><rect x="108" y="14" width="62" height="44" rx="7"/><path d="M180 36h18m-6-6 6 6-6 6"/><circle cx="218" cy="36" r="16" opacity=".4"/><path class="done" d="m210 36 6 6 11-13"/></g>
  <g fill="currentColor" font-family="sans-serif" font-size="9" text-anchor="middle"><text x="35" y="39">Sign in</text><text class="key" x="139" y="39">Create key</text></g>
</svg>

Screenshots / recordings

Setup and key-replacement screenshot gallery (fresh screenshots with sample data, including pending confirmation).

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR