fix(desktop): address second Copilot pass on xAI loopback flow

- onboarding: openSignInUrl now falls back to window.open when the desktop
  bridge's openExternal throws/rejects (OS handler missing, user denied),
  not just when the bridge is absent
- web_server: cancelling a loopback session shuts down the 127.0.0.1
  callback server + joins its thread immediately, freeing the port instead
  of holding it until the wait times out (+ regression test)
- web_server: document the new "loopback" flow in the /api/providers/oauth
  enum, the poll-endpoint docstring, and the Phase 2 flow comment block

apps/desktop/src/store/onboarding.ts

@@ -417,10 +417,18 @@ export async function refreshOnboarding(ctx: OnboardingContext) {
 // apps/desktop/src/app/artifacts/index.tsx.
 async function openSignInUrl(url: string) {
   if (window.hermesDesktop?.openExternal) {
-    await window.hermesDesktop.openExternal(url)
-  } else {
-    window.open(url, '_blank', 'noopener,noreferrer')
+    try {
+      await window.hermesDesktop.openExternal(url)
+
+      return
+    } catch {
+      // Bridge present but failed (no OS handler, user denied, etc.). Fall
+      // through to window.open so the sign-in URL still opens and the flow
+      // doesn't strand a pending OAuth session in a waiting state.
+    }
   }
+
+  window.open(url, '_blank', 'noopener,noreferrer')
 }
 
 export async function startProviderOAuth(provider: OAuthProvider, ctx: OnboardingContext) {