Prepare OAuth debugger foundations for future learning lessons

[chelojimenez]

Summary

• extract a reusable useOAuthFlowController hook from OAuthFlowTab and move flow orchestration, callback handling, modal timing, reset behavior, and token extraction into it
• add a shared OAuthFlowExperience shell plus a small capability/config layer so server-backed debugger flows and future fixed-profile learning flows can reuse the same UI without route wiring yet
• keep the existing debugger behavior intact, preserve shared OAuth step metadata as the canonical source, and keep the profile modal as the thin app-specific adapter surface
• add regression, controller, and presentation coverage for the debugger tab, the new controller, and capability-gated experience rendering

Testing

• npx vitest run client/src/components/oauth/__tests__/useOAuthFlowController.test.tsx client/src/components/oauth/__tests__/OAuthFlowExperience.test.tsx client/src/components/__tests__/OAuthFlowTab.test.tsx

Notes

• foundation-only change; no new Learning tab routes, lessons, or sidebar items are included here

---

Note

Medium Risk
Moderate risk because OAuth flow orchestration and callback handling were refactored into a new hook and the debugger UI was re-composed, which could subtly affect auth modal timing, reset behavior, or token application despite aiming to preserve behavior.

Overview
Refactors the OAuth debugger tab to use a new useOAuthFlowController hook for state-machine orchestration, OAuth callback processing (window message/BroadcastChannel), reset behavior, and token extraction, reducing OAuthFlowTab to app wiring + PostHog events.

Introduces a reusable OAuthFlowExperience layout with capability-gated actions via oauthFlowShared (e.g., supporting future fixed-profile lesson flows without editing/apply/refresh controls), and updates OAuthFlowLogger to respect these capability flags.

Simplifies OAuthAuthorizationModal to only manage the popup lifecycle (callback listening moved to the controller), adds comprehensive unit tests for the tab/controller/experience, and updates test setup to mock HTMLElement.scrollTo.

^{Written by Cursor Bugbot for commit 101a66d. This will update automatically on new commits. Configure here.}

[chelojimenez]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

New shared export duplicates existing local function

Low Severity

The newly exported describeRegistrationStrategy in oauthFlowShared.ts is identical to the existing local describeRegistrationStrategy in OAuthProfileModal.tsx. Since this PR specifically extracts shared utilities, OAuthProfileModal could import from the shared module instead of maintaining its own copy.