fix: rewrite Copilot driver with OAuth device flow authentication

[dmbutko]

Summary

Complete rewrite of the GitHub Copilot LLM driver to fix broken authentication and add proper OAuth device flow support.

Before: The driver expected a GITHUB_TOKEN env var, but no standard token type (PAT, fine-grained PAT, gh CLI token) works with the Copilot token exchange endpoint. Users couldn't use Copilot at all.

After: Zero-config authentication via OAuth device flow. User runs openfang config set-key github-copilot or selects Copilot during openfang init, authorizes in their browser, and it just works.

What changed

Driver (copilot.rs) — full rewrite

• OAuth device flow using Copilot's client ID (Iv1.b507a08c87ecfe98)
• Token chain: ghu_ access token → Copilot API token (tid=...), both cached automatically
• Token persistence to ~/.openfang/.copilot-tokens.json (0600 permissions)
• Proper Editor-Version / Editor-Plugin-Version / Copilot-Integration-Id headers
• Dynamic base URL from token exchange response (endpoints.api) — works with Individual, Business, and Enterprise plans

Dynamic model catalog

• Models fetched from {endpoints.api}/models on daemon startup
• Refreshed on model_not_supported error (retry once with updated list)
• Removed hardcoded copilot/gpt-4o and copilot/gpt-4 static entries
• Uses merge_discovered_models() to populate catalog at runtime

Init wizard (init_wizard.rs)

• New CopilotAuth TUI step between provider selection and model picker
• Shows device code + verification URL with spinner
• [Enter] to open browser (doesn't auto-open)
• After auth succeeds, fetches live model list and auto-advances to model picker
• User sees all available models (43 in Enterprise) with real-time data

CLI integration

• openfang config set-key github-copilot — runs interactive device flow
• openfang doctor — checks for Copilot auth token file, shows ✔ if authenticated
• Simplified driver instantiation in mod.rs — no env vars needed

Model catalog cleanup

• Removed 7 static Copilot model entries (replaced by dynamic fetch)
• Updated aliases (copilot → gpt-4o)
• Copilot auth detection via token file instead of env var

Testing

Tested end-to-end on Windows (x64 cross-compiled) with GitHub Copilot Enterprise:

Test	Result
Device flow authentication	✔
Token exchange (copilot_internal/v2/token)	✔ 200 OK
Live model fetch	✔ 43 models
Chat completion (claude-opus-4.6-1m)	✔
openfang init full wizard flow	✔
openfang config set-key github-copilot	✔
openfang doctor	✔ "All checks passed"
openfang start (daemon boot with model fetch)	✔
/model switcher in chat TUI	✔ shows live models

Why not use the Copilot SDK?

The official @github/copilot-sdk is TypeScript/Node and spawns the Copilot CLI as a subprocess. OpenFang is Rust and only needs Copilot as a completion endpoint. Direct API integration is simpler and has no Node.js dependency.

Why this client ID?

Iv1.b507a08c87ecfe98 is the VS Code Copilot extension's OAuth App client ID. The copilot_internal/v2/token endpoint only accepts ghu_ tokens from this specific app — custom OAuth Apps produce gho_ tokens which are rejected with 404. This is the same approach used by shell-ask, aider, continue.dev, and every other non-SDK Copilot integration.

Closes #1014