feat(desktop): use Copilot CLI OAuth instead of requiring a token

> 🤖 Generated by the Agentic Engineer

Part of #6457. Depends on the mechanism confirmation.

## Problem

`desktop/main.go` gates the assistant behind a token:

> the assistant stays hidden in the UI until a Copilot token (`KSAIL_COPILOT_TOKEN` /
> `COPILOT_TOKEN`) is configured

So a desktop user with a perfectly good `copilot auth login` sees **no assistant at all** — not a
prompt to sign in, just an absent feature. The gate is inherited from the webchat server path, whose
justification is *"a server cannot drive the interactive device login"*.

That reasoning does not transfer. The desktop app runs **on the user's own machine, with the user
present**. It is the same situation the CLI interface already handles without a token.

## Expected behaviour

The desktop assistant is available whenever the Copilot CLI is authenticated, with no token. A token
remains an override.

When neither is available, the UI says so and points at `copilot auth login` — a visible, actionable
empty state rather than a silently missing feature.

## Acceptance criteria

- CLI authenticated, no token → assistant visible and working.
- Token set → unchanged from today.
- Neither → assistant visible but clearly unavailable, naming the fix. Not hidden.
- Note for implementation: the desktop app spawns the CLI without a TTY, which is exactly what the
Spike's Q2 settles — do not start this until that answer exists.

Start by reading desktop/main.go to trace how the token currently gates the assistant. Confirm the Spike's Q2 mechanism answer before changing the desktop CLI invocation, then verify the three acceptance cases: authenticated CLI, token override, and a visible empty state directing users to `copilot auth login`.

Written by the indexing model from the issue text.