Add managed Pi provider authentication to Desktop UI

## Problem

Buzz Desktop-managed Pi runtimes use an app-private `PI_CODING_AGENT_DIR` so they do not read or write host `~/.pi/agent` state. This correctly isolates Pi authentication too, but Desktop currently has no UI for authenticating providers in that managed directory.

For OAuth providers such as `openai-codex`, users must leave Buzz and launch Pi manually with Buzz's managed directory, run `/login`, then restart affected agents. Without that step, the requested provider/model is absent from Pi's catalog and Pi retains its native default-model behavior.

## Desired behavior

Provide a Desktop workflow for managing Pi provider authentication in Buzz-owned state:

- show provider authentication status without exposing credentials;
- support login and logout, including browser-based OAuth flows;
- store credentials only in the installation's app-private Pi directory;
- never read, copy, or migrate host `~/.pi/agent` authentication;
- preserve separate dev/release app-data roots;
- refresh model discovery after authentication and clearly prompt for any required agent restart;
- avoid logging tokens, OAuth responses, or secret-bearing IPC payloads;
- preserve Pi's native provider/model fallback behavior.

## Current workaround

Launch Pi with the active Buzz installation's `PI_CODING_AGENT_DIR`, run `/login`, complete provider authentication, exit, and restart affected managed agents.

## Acceptance criteria

1. A user can authenticate and log out of a Pi provider from Buzz Desktop.
2. OAuth completion writes only to the effective Buzz-owned Pi directory.
3. Host `~/.pi/agent` remains untouched.
4. Model/provider discovery refreshes after auth changes.
5. Errors are actionable and contain no secrets.
6. Automated tests cover path ownership, cancellation, failed OAuth, logout, redaction, and dev/release isolation.

Start by tracing the Desktop-managed Pi runtime's effective PI_CODING_AGENT_DIR and the existing provider authentication or OAuth entry points. Review the automated-test setup before covering path ownership, cancellation, failed OAuth, logout, redaction, model refresh, and dev/release isolation; done means all acceptance criteria pass without touching host ~/.pi/agent.

Written by the indexing model from the issue text.