feat: added /auth command to re-authenticate with custom provider

[roerohan]

Issue for this PR

Closes #

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

When a well-known auth token (e.g. a JWT from an enterprise provider like opencode.example.com) expires mid-session, you currently have to quit opencode, run opencode auth login <url> in your shell, and restart - losing your session context. This adds a /auth slash command so you can re-authenticate without leaving the TUI.

How it works:

• /auth with no args looks up existing well-known entries from auth.json. If there's one, it re-runs the auth flow automatically. If there are multiple, it shows a picker. If there are none, it tells you to use /auth <url>.
• /auth <url> authenticates with the given well-known URL (new or existing) by fetching its .well-known/opencode config, running the auth command, and storing the token.
• After re-auth, the instance is disposed and re-bootstrapped (same pattern as /connect) so the new token takes effect immediately.

I also extracted the inline well-known auth logic from the CLI opencode auth login command into a shared Auth.wellknown() function so both the CLI and TUI use the same code path. The well-known config response is now validated with a Zod schema instead of as any, and stderr is captured on auth command failure for better error messages.

How did you verify your code works?

• bun run typecheck passes clean
• bun test - 756 pass, 0 fail
• Tested bun dev launches the TUI with /auth available in the command palette

Screenshots / recordings

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR