fix(desktop): launch Databricks OAuth from passive model discovery

[wpfleger96]

When a user's agent runtime is buzz-agent with no cached Databricks OAuth token, the desktop app's passive model-discovery surfaces were forbidden from launching interactive auth. Discovery failed silently, so the model dropdown showed only built-in fallback models behind a vague "Could not load live models for databricks_v2" note (reported internally by Nick and Jose).

What changed

Both discovery surfaces — the passive draft-form discovery and the explicit saved-model picker — now launch the browser OAuth flow, matching goose's behavior. The only behavioral difference between them is cooldown handling:

• Passive draft discovery fires on every form-state change, so a failed, cancelled, or timed-out sign-in records a per-host cooldown (5 min) that suppresses re-popping the browser on the next keystroke. While the cooldown is active it returns the "sign-in required" guidance instead of relaunching.
• The explicit model picker is a deliberate user action, so it always launches and clears any stale cooldown first.

Safety rails:

• A 150s hard timeout (AUTH_FLOW_TIMEOUT) bounds the whole interactive flow so an abandoned SSO tab fails discovery cleanly rather than wedging the dropdown. Success clears the cooldown; failure and timeout both record it.
• AuthCooldown recovers from a poisoned lock rather than wedging every future sign-in on one panic.

The frontend maps the terminal Databricks sign-in states to typed, actionable copy in formatModelDiscoveryErrorStatus: "sign-in required" is a muted note pointing at the picker and buzz-agent auth databricks; a failed or timed-out sign-in is a warning pointing at the explicit retry. Other Databricks failures fall through to the existing generic notice.

Scope

Changes are confined to Databricks discovery and its frontend status formatter — no agent_models.rs call sites are touched. The interactive-auth helper takes an injected timeout so the timeout/cooldown policy is unit-testable without a live browser.

[wpfleger96]

Superseded by #5607 — same commits (57a5d4b), moved to a head branch on block/buzz per repo policy (fork heads are for third-party OSS only).