feat(makelore): add platform oidc login

electron/api/routes/auth.ts

@@ -27,6 +27,7 @@ import {
   getRememberedPasswordState,
   updateRememberedPassword,
 } from '../../services/remembered-password';
+import { startPlatformAuthorization } from '../../services/platform-auth';
 
 type PasswordLoginInput = {
   username?: unknown;
@@ -335,6 +336,22 @@ async function handlePasswordLogin(
   });
 }
 
+async function handlePlatformAuthorizationStart(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<void> {
+  // Keep the route body intentionally empty: the Main process owns the OIDC
+  // client configuration and all PKCE state. The renderer only receives a
+  // browser URL and never handles a client secret.
+  readExactJsonObject(await parseJsonBody<Record<string, unknown>>(req), []);
+  const authorization = await startPlatformAuthorization();
+  sendJson(res, 200, {
+    success: true,
+    requestId: authorization.requestId,
+    authorizationUrl: authorization.authorizationUrl,
+  });
+}
+
 async function handleRememberedPassword(res: ServerResponse): Promise<void> {
   const state = await getRememberedPasswordState();
   res.setHeader('Cache-Control', 'no-store');
@@ -791,6 +808,11 @@ export async function handleAuthRoutes(
       return true;
     }
 
+    if (url.pathname === '/api/auth/platform/start' && req.method === 'POST') {
+      await handlePlatformAuthorizationStart(req, res);
+      return true;
+    }
+
     if (url.pathname === '/api/auth/remembered-password' && req.method === 'GET') {
       await handleRememberedPassword(res);
       return true;