cli: configure and launch with a custom OAuth app

[andy-xu-db]

What this does

Makes the flag usable end to end: ug claude --oauth-client-id <id> — also ug codex, bare ug, and ug configure — signs in through a custom OAuth app, and every agent config it writes keeps minting from that same app.

• Persist first, then authenticate. The login and gateway probe both read the id from state, so it's saved before they run. None inherits (like use_pat), so re-launches can drop the flag; --oauth-client-id "" reverts to the built-in app.
• Configs pin the id rather than resolving at run time, because an agent runs its token helper as a bare command line: Claude's apiKeyHelper, Codex's auth.args (current + legacy overlay), opencode's plugin, the ucode mcp-proxy argv, both smart-routing hooks.
• Cache guard. An --oauth-client-id that disagrees with the cached config forces a reconfigure instead of launching with a helper pointed at the other app.

No change needed in doctor.py or smart_routing/v2.py.

Rollout: the flag only picks the app — the integration itself still needs refresh_token_ttl_in_minutes = 129600, since new ones default to 10080 (7 days).

Jira: AIGTWY-4550

Testing

uv run pytest 2,349 passed (+27, same 21 pre-existing failures; 2,249 → 2,349 across the stack); ruff check, ruff format --check, ty check src/ clean. New tests cover persist-before-auth, inheritance, "" clearing, the cached-config rejection, flag forwarding for claude/codex, and the pinned id in every generated config.

🥞 Stacked PR

• stack/oauth-pkce-module [Files changed]
  • stack/oauth-auth-token-flag [Files changed]
    • stack/oauth-configure-client-id [Files changed] ← this PR

---

This pull request and its description were written by Isaac.