fix(auth): open OAuth popup before async PKCE

Browsers block window.open after an await because the user
gesture is lost. Open a blank tab synchronously first, then
set the URL after PKCE generation completes.

src/components/settings/ai-model-tab.tsx

@@ -317,10 +317,13 @@ function ProviderConfigSection({
   }
 
   const handleOAuthConnect = async (): Promise<void> => {
+    // Open window immediately in the click handler to avoid
+    // popup blockers (async gap kills the user gesture)
+    const popup = window.open("about:blank", "_blank", "noopener")
     const { verifier, challenge } = await generatePKCE()
     const url = buildAuthUrl(challenge)
+    if (popup) popup.location.href = url
     setOAuth({ step: "connecting", verifier })
-    window.open(url, "_blank", "noopener")
   }
 
   const handleOAuthSubmit = async (): Promise<void> => {