Bug: /login OAuth wait cannot be cancelled with Esc

Summary

When users run /login in the shell UI and choose Kimi Code, the device authorization flow enters a Waiting for user authorization... state that cannot be cancelled with Esc.

Steps to reproduce

1. Start the shell UI.
2. Run /login.
3. Select Kimi Code.
4. Wait until the CLI shows Waiting for user authorization....
5. Press Esc.

Actual behavior

The shell stays stuck in the waiting state and does not return to the prompt.

Expected behavior

Esc (and other user interrupt paths such as Ctrl+C) should cancel the OAuth wait loop and return control to the shell prompt.

Root cause

The OAuth device polling loop does not expose a cancel signal, and the shell-level /login flow does not attach the waiting state to the existing interactive cancel handling used by running prompts.

Impact

Users can get trapped in the login flow if they decide not to finish browser authorization immediately.

Start at the shell UI's /login flow and the OAuth device polling loop, then compare them with the existing interactive cancel handling used by running prompts. Done means Esc and Ctrl+C interrupt the authorization wait and return the user to the shell prompt; verify the behavior through the login flow's tests or a shell UI reproduction.