feat(vercel): sign in and choose a Gateway billing team - #5

Signing in to Vercel does not select an AI Gateway billing team. A real test app completed device authorization, but inference returned 401 until the request supplied an authorized team in x-vercel-ai-gateway-team.

This adds Sign in with Vercel → choose a billing team → connect. The app token lists authorized teams with read:team; the user confirms one, and OpenCode saves its ID with that OAuth connection. Native Gateway inference sends the connection's token and team together. No API key is created.

An experimental post-sign-in setup form carries this step through the server, generated clients, desktop, CLI, and TUI. Credentials stay in memory until confirmation; status responses expose only form fields. Missing Team Read, no available teams, cancellation, and expiry do not save a partial connection. Refresh preserves the team and original client binding.

The shared review base remains vercel-oauth-base (upstream dev snapshot d3ad3da99e10b7978f467dc44e166ce4e2055fae). Companion documentation: #6. The release client still needs maintainer configuration and Vercel activation; the personal test client is not included in this PR.

Adversarial review fixes keep post-OAuth discovery cancellable until credential persistence, recheck terminal status before the TUI reports a connection, preserve hidden setup defaults in desktop, and retain public SDK form-field exports and numeric attempt timestamps.

Validation: 178 focused fixture tests pass: 106 provider/integration/model-resolution, 10 credential lifecycle/refresh, 31 CLI, 14 TUI, four client contract, and 13 built-browser provider tests. Another 23 file-lock tests passed, for 201 executed tests in total. They include negative token/team responses, cancel/expire during discovery, CLI and TUI terminal failures after setup, hidden defaults, and published SDK compatibility. bun run check passes all 35 tasks; official core/CLI TypeScript and generated-client consistency checks pass. Astra follow-up review found no further actionable issues in the fixes.

Live verification (2026-10-29): the new packaged build completed fresh Vercel device consent with both permissions, listed the authorized teams, and saved the explicitly selected philippcomans-1463 team with the OAuth credential. With no manual provider header configured, its server returned HTTP 200 / 703 for 37 × 19. A real desktop chat using Vercel / GPT 5.4 Nano returned 225 for 58 + 167 and completed successfully. No Gateway API key was used.

Live revocation and recovery also passed for the test app: revoked access and refresh tokens introspected inactive; refresh returned invalid_grant; Gateway and desktop chat reported authentication failure while retaining the saved credential. One initial request still succeeded before later requests were rejected, so immediate propagation and cache duration are not established. Fresh sign-in initially found no usable teams after the app changed to v2 permissions with required installation. Installing it on philippcomans-1463 with both permissions, repeating consent, and confirming that team saved a new active connection. The old token remained revoked; server inference returned HTTP 200 / 109 for 41 + 68, and a real desktop chat returned 109 with a successful outcome.

Additional live account testing passed with the reviewed packaged runtime: a second connection was added alongside the original; both could be selected and perform inference; desktop cancellation before and after consent saved nothing. Revoking only the added connection left the original working. Gateway returned 401 about 89 seconds after revocation in this run. Recovery used the real interactive CLI, which required confirmation of the billing team before saving; server and desktop inference returned 76. Deleting the inactive revoked test entry by ID preserved the active original. Natural automatic refresh passed at 21:04:22 UTC: the unchanged original pair rotated during inference, both concurrent requests and the next request returned 93, the same connection/team/client metadata was retained, new access introspected active, and the old refresh token inactive. No browser approval, fabricated expiry, or manual refresh exchange was used. This verifies renewal when used near expiry, not periodic idle renewal or exactly one live token exchange.

Remaining release checks: configure and validate the maintainer-owned client, confirm the beta device-consent screen displays the requested API permissions, and validate supported platforms and teams. The personal test client and screenshots remain local test artifacts.

Visual

<svg xmlns="http://www.w3.org/2000/svg" width="240" height="72" viewBox="0 0 240 72" fill="none">
  <style>@keyframes pulse{0%,100%{opacity:.3}45%{opacity:1}}.step{animation:pulse 3s infinite}.two{animation-delay:1s}.three{animation-delay:2s}@media(prefers-reduced-motion:reduce){.step{animation:none}}</style>
  <g stroke="currentColor"><rect class="step" x="4" y="20" width="66" height="32" rx="6"/><rect class="step two" x="87" y="20" width="66" height="32" rx="6"/><rect class="step three" x="170" y="20" width="66" height="32" rx="6"/><path opacity=".5" d="M74 36h9m-3-3 3 3-3 3m77-3h9m-3-3 3 3-3 3"/></g>
  <g fill="currentColor" font-family="sans-serif" font-size="12" text-anchor="middle"><text x="37" y="40">Sign in</text><text x="120" y="40">Team</text><text x="203" y="40">Ready</text></g>
</svg>