Summary

Phase 2 of the Command Palette built-in OAuth authorization flow: the host-side redirect broker. This is the second of a stack of 4 draft PRs and targets the Phase 1 branch (dev/mjolley/cmdpal-auth-flow, #49440).

Command Palette acts as a thin, hardened redirect broker. It allocates the redirect target, injects a cryptographically random state, opens the browser, captures the single redirect, validates state, and hands the raw response parameters back to the extension. Command Palette never sees the PKCE verifier and never stores third-party tokens; the Toolkit's OAuthClient performs the code exchange inside the extension's process.

What this adds

• AuthBrokerService (Microsoft.CmdPal.UI.ViewModels/Auth): 256-bit state generation with single-use, fixed-time validation; parameter composition (appends redirect_uri and state); loopback and custom-scheme flows; timeout (default 60s, cap 300s), cancellation, concurrency, and teardown handling; non-blocking status via the host. Auth codes and tokens are never logged.
• Loopback capture bound to 127.0.0.1 only via a raw TcpListener, so no HTTP.SYS URL ACL and no elevation are required inside the packaged process.
• Custom scheme x-cmdpal://auth/callback routed by state from MainWindow.HandleLaunchNonUI, reusing the existing single-instance protocol activation wiring.
• AppExtensionHost implements IExtensionHost2.RequestAuthorizationAsync, delegating to the broker.
• Testability seams (IAuthBrokerPlatform, ILoopbackRedirectListenerFactory) with a default platform and a UI platform that re-foregrounds the window on capture.

Testing

• Build: build.ps1 -Path src\modules\cmdpal -Platform x64 -Configuration Debug, exit code 0.
• 14 new Auth unit tests (state generation, parameter composition and override, URL building, loopback happy path and state-mismatch and provider-error and timeout and cancel, cancel-all-flows, custom-scheme unknown-state and happy path and single-use), plus a real loopback TCP integration test.
• All CmdPal *.UnitTests projects pass with zero failures.

Scope

Changes are limited to src/modules/cmdpal (CommandPalette.slnf). No XAML changed. Draft while the rest of the stack lands.