Adapt login to WorkOS Connect: issuer config, sid-aware revocation, branded callback page

[jordanalexmeyer]

Summary

Adapts extend login / extend logout (added in #31) to the WorkOS Connect Standalone authorization server that replaces the home-grown OAuth provider (extend-web PR extend-hq/extend-web#6961).

What changed

Auth server resolution (internal/cli/env.go, login.go)

• New env vars: EXTEND_OAUTH_ISSUER (the AuthKit domain, e.g. https://auth.extend.ai — required for extend login, fails with instructions when unset) and EXTEND_OAUTH_CLIENT_ID (defaults to the built-in first-party client).
• OAuth discovery and token calls are pinned to the issuer; API calls stay pinned to the API base. Authorization requests carry the RFC 8707 resource indicator (the API base URL).

Logout / revocation (login.go)

• WorkOS Connect has no RFC 7009 revocation endpoint. Logout now calls the API's POST /oauth/revoke-current with the access token (refreshing first when stale); the API denylists the token's sid, killing every token of the login instantly. Stored records no longer carry a RevocationEndpoint.
• Same-sid guard: WorkOS reuses the consent while it is on file, so a re-login issues tokens with the same sid as the grant it replaces. Revocation is sid-keyed, so revoking the replaced grant killed the brand-new session (second login's /me failed, and the following logout got a 401). Login now decodes the sid claim from both tokens (oauth.TokenSID, unverified local read) and skips the revoke when they match; opaque/undecodable tokens still revoke best-effort as before.

Loopback callback page (internal/oauth/loopback.go)

• Restyled to the Extend dashboard design tokens (same palette as the AuthKit custom CSS): warm background, card surface, compact type scale, and dark mode via light-dark(); the logomark renders via currentColor.

Tests

• TestRunLoginSkipsRevokingSameConsentGrant / TestRunLoginRevokesDifferentConsentGrant — the sid guard, plus the existing opaque-token revoke path.
• TestTokenSID — claim extraction table test (WorkOS JWT, missing claim, opaque, malformed).
• Existing login/logout suites updated for issuer-based discovery and /oauth/revoke-current.
• go test ./internal/... green; verified end-to-end against a devbox running the extend-web branch (login → consent → API calls → logout revocation).

Notes

• A replaced same-sid login's refresh token stays valid at WorkOS until logout (revoking it would kill the shared consent); it is superseded ciphertext in the same keychain, and logout still revokes the whole consent at once.