test: cover v2/main mid-session-auth code to the ≥90% per-file gate (cliOAuth.ts, TUI App.tsx, AuthTab.tsx) #1610

Problem

v2/main's mid-session / step-up auth code (merged via #1608) falls below the ≥90% per-file coverage gate on all four dimensions for several files. This is invisible on v2/main because v2/main's CI does not run the coverage gate — .github/workflows/main.yml on v2/main explicitly notes npm run coverage is "intentionally NOT run in CI" (it runs validate → test:integration → smoke → storybook only).

The gate (#1550) is run in the Wave-1 rollup (1579-wave-1, PR #1601), so merging v2/main into that branch turns CI red on these pre-existing gaps. They are not introduced by the merge — running npm run coverage on a clean v2/main checkout reproduces every failure below.

Failing files (measured on v2/main @ d825af37)

The uncovered cliOAuth.ts paths are the interactive step-up code: confirmStepUpFromStdin() (default stdin confirmer) and the AuthRecoveryRequiredError branch of connectInspectorWithOAuth. The existing tests inject a mock confirmer / hit the isUnauthorizedError path, so those lines are never exercised. AuthTab.tsx and App.tsx gaps are the new mid-session-auth TUI surface (keypress handlers, the auth tab's recovery/step-up UI) not reached by the current ink renderer tests.

Decision / approach

Fix at the source on v2/main (not in the rollup), then re-merge v2/main into 1579-wave-1:

• clients/cli/src/cliOAuth.ts → ≥90 on all four dimensions
• clients/tui/src/components/AuthTab.tsx → ≥90 on all four dimensions
• clients/tui/src/App.tsx → ≥90 on all four dimensions (largest effort — extend the ink-testing-library renderer tests to drive the mid-session-auth keypress/UI paths)
• Verify npm run coverage is green from the repo root on v2/main
• Re-merge v2/main into 1579-wave-1 and confirm the rollup CI is green

Note — a working cliOAuth.ts fix already exists

While resolving the v2/main → 1579-wave-1 merge, cliOAuth.ts was already brought to 100 / 96.42 / 100 / 100 by adding unit tests in clients/cli/__tests__/cliOAuth.test.ts (covering confirmStepUpFromStdin via a mocked node:readline/promises, and the AuthRecoveryRequiredError / isUnauthorizedError branches of connectInspectorWithOAuth). That diff can be lifted onto the v2/main PR verbatim — only the two TUI files need net-new work.

Acceptance criteria

• npm run coverage passes (per-file ≥90 on lines/statements/functions/branches) on v2/main.
• No coverage regressions elsewhere; no new v8 ignore used to mask reachable-but-untested code.