feat(cloud): sync managed providers to workers

[pascalandr]

Replaces #1891, #1939, #1940, and #1941.

Summary:

• Adds managed provider contract, OAuth-backed Den provider flow, desktop bootstrap state, and app import/sync UX.
• Syncs providers by worker-owner access and revokes runtime aliases when access is removed.
• Hardens remote connect links to prefer client tokens and scopes desktop browser proxy auth/CDP commands safely after upstream browser changes.

Verification:

• pnpm --filter @openwork/app typecheck
• pnpm --dir "apps/server" typecheck
• pnpm --dir "ee/apps/den-api" exec tsc -p tsconfig.json --noEmit
• pnpm --dir "ee/apps/den-api" exec bun test --timeout 30000 test/managed-provider-sync.test.ts test/desktop-handoff.test.ts test/llm-provider-access-lifecycle.test.ts test/llm-provider-credentials.test.ts test/llm-providers-oauth.test.ts
• pnpm --dir "apps/desktop" exec node --test electron/browser-native-tools.test.mjs electron/remote-workspace.test.mjs electron/desktop-fetch.test.mjs electron/bootstrap-config.test.mjs electron/opencode-config-json.test.mjs electron/runtime.test.mjs

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jun 12, 2026 11:09am

[vercel]

@pascalandr is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

7 issues found across 79 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 10 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>