fix: harden Pages, remote sync, and subscription auth

[bobleer]

Summary

• Close the non-PPT-Live product gaps found during the cross-platform UI, UX, and functional review.
• Harden Pages publishing and execution, subscription-provider authentication, remote account/device synchronization, and mobile/desktop interaction states.
• Add focused regression coverage and an OS CI matrix for the affected Rust services.

PPT Live is intentionally out of scope and is not changed by this PR.

Key changes

Pages

• Restore a complete Pages management scene with title, visibility, version, deploy, rollback, unpublish, delete, and open-link workflows.
• Require fresh account-scoped approval for sensitive Page operations and prevent persistent allow rules from bypassing that approval.
• Isolate uploads with upload IDs and full manifests, serialize uploads per Page, reject stale sessions, and make deletion transactional.
• Reject symlinks and paths outside the source root; add function timeouts, request/body limits, concurrency and quota guards, scoped one-time grants, and unsafe response-header filtering.
• Declare the remote-workspace policy and provide clear unsupported-state guidance for directory-based remote publishing.

Subscription authentication

• Unify the in-app login lifecycle for Codex, Antigravity, and OpenCode, including cancellation, retry, logout, and persistence race handling.
• Move credentials to the system vault with atomic metadata updates, legacy plaintext migration, and chunked long-token storage that stays within Windows credential limits.
• Distinguish missing credentials from an unavailable/locked vault and surface retryable states in the UI.
• Harden OAuth state handling and local callback behavior, with localized and theme-aware callback pages.

Remote and mobile experience

• Add operation generations, transition gates, and locking across the desktop, CLI, and shared synchronization engine so stale progress cannot overwrite current state.
• Cancel detached retry work on logout/device removal and treat partial session uploads as resumable failures.
• Improve confirmation, clipboard fallback, keyboard/touch accessibility, safe-area handling, relative time, locale behavior, and peer fallback when cloud synchronization is unavailable.

Shared UX

• Make typewriter rendering grapheme-safe, reduced-motion aware, and resilient to background-tab throttling.
• Improve permission and file-operation error states and add focused regression tests.

Verification

• pnpm run lint:web
• pnpm run type-check:web
• pnpm --dir src/mobile-web run type-check
• Focused Web UI tests: 9 files, 55 tests passed
• pnpm run build:web
• pnpm run build:mobile-web
• pnpm run i18n:contract:test (37 passed)
• pnpm run i18n:audit (0 warnings)
• pnpm run theme:color-audit:all
• pnpm run check:github-config
• pnpm run check:repo-hygiene
• node --test scripts/check-core-boundaries.test.mjs (16 passed)
• cargo test -p bitfun-page-function-runtime (5 passed)
• cargo test -p bitfun-relay-service (55 passed)
• cargo test -p bitfun-relay-server --test library_compat (1 passed)
• cargo test -p bitfun-ai-adapters --features subscription-auth subscription_auth (30 passed)
• cargo test -p bitfun-services-integrations --features remote-connect page_upload (7 passed)
• Focused Page publish/deploy/pipeline and remote-sync Rust tests passed
• cargo check -p bitfun-desktop -p bitfun-cli
• pnpm run fmt:rs
• git diff --check

Follow-up

Pages under /p still share the relay/mobile origin. Credential stripping, scoped grants, and response-header filtering mitigate the current risk, but full isolation should move Pages to a dedicated domain or port with strict CORS. Windows and Linux cross-compilation was not available on the local macOS host; the added CI matrix covers the targeted affected services on macOS, Ubuntu, and Windows.