feat(account): add hosted allowance and secure OAuth return

[HonQii]

What changed

• add Supabase Google PKCE sign-in and a hosted StashBase allowance alongside OpenAI/OpenRouter BYOK
• enforce the shared allowance for indexing and semantic queries while preserving Exact search at zero quota
• recover indexing after quota reset or switching to an available BYOK source
• show quota percentage and reset date in the account UI
• return browser OAuth to the initiating desktop window with a fixed data-free deep link and process-authenticated acknowledgement
• preserve malformed/unrelated configuration and add the account/retrieval gates to the cross-platform source matrix

Why

StashBase needs an open-source desktop client that can use either user-owned API credentials or a signed-in hosted allowance. The initial implementation did not make quota exhaustion authoritative across every semantic path and had callback/configuration edge cases that could retry exhausted work, focus the wrong window, or overwrite malformed configuration.

User impact

Signed-in users can use the included allowance without entering an API key. When it is exhausted, vector indexing and semantic search pause clearly, Exact search continues, and work resumes after reset. BYOK remains independently configurable. Browser sign-in returns to the window that initiated it and closes the callback only after native confirmation.

Validation

• pnpm typecheck
• pnpm test:config (13 passed)
• pnpm test:renderer (254 passed)
• npm run test:electron (81 passed)
• pnpm test:conversion-scheduler (128 passed)
• pnpm test:python (27 passed)
• pnpm test:agent (104 passed)
• pnpm test:retrieval, pnpm test:library-files, pnpm test:mcp
• pnpm test:docs
• pnpm build
• pnpm test:electron:smoke
• pnpm test:e2e:smoke (5 passed)
• pnpm test:e2e:functional (28 passed)
• standards and spec reviews: no findings