remote/oidc: identity client + browser opener + login orchestrator (T3, T5)

[platypii]

Chunk 2 of the OIDC client login (LLP 0046-0048), completing milestone-1 primitives. Stacked on #197 (base is chunk1-pkce-loopback); review/merge after #197.

What

• identity_client.js - exchangeCode / refreshSession over an injectable fetch against <origin>/v1/identity/token; a 401 invalid_grant becomes a typed InvalidGrantError. Field is access_jwt, expires_at is ISO; no external JWKS (LLP 0047 wire contract).
• open_browser.js - platform opener (open / xdg-open / cmd start), detached; returns whether an opener was found (LLP 0046 D8).
• oidc_login.js - loginWithBrowser() composes PKCE + random state + loopback + /login/start + exchange, returns the session (no persistence) (LLP 0046 D2/D3).
• types.d.ts - OidcSession / RefreshedAccess.

Tests

3 new test files, 13 tests green; npm run typecheck clean.

🤖 Generated with Claude Code

[platypii]

Review (independent agent review)

Verdict: request-changes → addressed. The identity client and login orchestrator are faithful to the LLP 0047 wire contract (correct grants, access_jwt/expires_at parsing, typed invalid_grant only on 401, no secret logging, clean try/finally loopback cleanup, proper URL/S256 start-URL building). Conventions clean.

Findings

• blocker — open_browser.js crashed on a missing opener.spawn delivers a missing-binary failure (ENOENT) as an async 'error' event, not a synchronous throw. With no listener attached, that became an uncaught exception that crashed the CLI — exactly the D8 "no opener, print the URL" path. Verified empirically by the reviewer. The failure test was tautological (threw synchronously, which real spawn never does), masking it.
• minor — Windows & in the URL via cmd /c start "" <url> (unquoted query separators).
• minor — expires_at validated only as a non-empty string, not a parseable ISO timestamp.

Addressed in this PR

• open_browser.js now attaches child.on('error', () => {}) so the async failure can never crash the process; the boolean return is documented as best-effort (a silently-failed launcher still returns true), with the loopback timeout + printed URL as the real backstops.
• The login orchestrator now always prints the URL as a fallback even on the "opened" path, so a silently-failed opener never strands the user.
• The failure test now models spawn's async 'error' emission (an EventEmitter child) and asserts the process does not crash; a separate test keeps the synchronous-throw path.

The expires_at ISO-parse hardening is effectively covered downstream: the attach-path freshness check (PR #201) treats an unparseable expiresAt as stale and refreshes. The Windows &-quoting nit is noted as a follow-up. 14 tests green, typecheck clean.