feat(copilot): reauthenticate expired sessions in chat

[FreddyJD]

Why

Automatic Copilot token renewal now handles routine expiry, but GitHub can still revoke authorization or let the refresh credential expire. When that happens, sending users to Settings adds unnecessary friction.

What Changed

• Show an inline recovery panel directly above the chat composer when Copilot authorization cannot be recovered automatically.
• Reuse the GitHub device-code flow in chat: display and copy the code, open GitHub authentication, retry an expired device code, and confirm reconnection.
• Preserve the user's composer draft and never automatically resend the failed turn or rerun tools.
• Recognize revoked/expired refresh grants returned as either HTTP 200 OAuth errors or HTTP 400 OAuth errors.
• Offer reauthentication only after automatic retries are exhausted.
• Do not show it for temporary outages, rate limits, organization-policy denials, subscription failures, aborted requests, or locked keychains.
• Ignore stale failures from an old account after a reconnect/account switch.
• Extract the existing Copilot setup component so onboarding and inline recovery share one sign-in implementation.
• Bump package and lockfile to 0.0.98.

User Experience

The inline panel says that GitHub Copilot auth can be unreliable and provides Refresh GitHub Copilot login. After starting the flow, the user gets the device code plus Authenticate on GitHub, without leaving chat for Settings.

Verification

• npm run build: passed, including node and web typechecks
• npm run smoke:app: 731 checks passed, including expanded Copilot auth coverage
• npm run smoke:canvas: 141 real-browser checks passed, including keyboard activation, code copying, GitHub launch, retry, narrow layout, reconnect confirmation, and draft preservation
• npm run smoke:shared: 1094 checks passed
• npm run smoke:store: passed
• npm run smoke:i18n: 18 checks passed
• npm run i18n: all 656-key catalogs in sync
• Changed-file Prettier and git diff --check: passed

One initial canvas run hit an existing flaky scrollbar-drag assertion before reaching the Copilot tests. The immediate rerun passed all 141 checks, including the new reconnect flow.