fix(desktop): launch Databricks OAuth from passive model discovery

[wpfleger96]

When a user's agent runtime is buzz-agent with no cached Databricks OAuth token, the desktop app's passive model-discovery surfaces were forbidden from launching interactive auth. Discovery failed silently, so the model dropdown showed only built-in fallback models behind a vague "Could not load live models for databricks_v2" note (reported internally by Nick and Jose).

What changed

Both discovery surfaces — the passive draft-form discovery and the explicit saved-model picker — now launch the browser OAuth flow, matching goose's behavior. The only behavioral difference between them is cooldown handling:

• Passive draft discovery fires on every form-state change, so a failed, cancelled, or timed-out sign-in records a per-host cooldown (5 min) that suppresses re-popping the browser on the next keystroke. While the cooldown is active it returns the "sign-in required" guidance instead of relaunching.
• The explicit model picker is a deliberate user action, so it always launches and clears any stale cooldown first.

Safety rails:

• A 150s hard timeout (AUTH_FLOW_TIMEOUT) bounds the whole interactive flow so an abandoned SSO tab fails discovery cleanly rather than wedging the dropdown. Success clears the cooldown; failure and timeout both record it.
• AuthCooldown recovers from a poisoned lock rather than wedging every future sign-in on one panic.

The frontend maps the terminal Databricks sign-in states to typed, actionable copy in formatModelDiscoveryErrorStatus: "sign-in required" is a muted note pointing at the picker and buzz-agent auth databricks; a failed or timed-out sign-in is a warning pointing at the explicit retry. Other Databricks failures fall through to the existing generic notice.

Scope

Changes are confined to Databricks discovery and its frontend status formatter — no agent_models.rs call sites are touched. The interactive-auth helper takes an injected timeout so the timeout/cooldown policy is unit-testable without a live browser.

Deferred

Cooldown keys use the raw trimmed DATABRICKS_HOST, while the catalog and OAuth cache normalize trailing slashes (crates/buzz-agent/src/catalog.rs:96, crates/buzz-agent/src/llm.rs:2046). So https://workspace/ and https://workspace share credentials but get separate cooldown entries — an equivalent-spelling change to the host field mid-cooldown can re-pop passive OAuth once within the 5-minute window. Self-limiting (one extra browser launch, never auth corruption). Follow-up: a trim_end_matches('/') on the cooldown key plus an equivalent-host test, picked up with the coordinator migration if #5545 ever merges.

[kalvinnchau]

Reviewed at 57a5d4b42130cf31921256c60f3763f829ff3597 against 397796c5f343db4251198f44505b1afebe88223f.

No blocking findings. I traced passive draft/form discovery, the saved-agent model picker, runtime inference, cache and refresh failure states, static-token precedence, concurrency, cancellation/timeout, cooldown behavior, and the OSS/internal release configuration split. The remaining trailing-slash cooldown-key normalization is nonblocking.