fix(desktop): clear the OAuth partition before remote sign-in

Sign out of the dedicated OAuth partition before opening the login window so a
stale gateway/identity-provider cookie can't silently bounce an expired session
straight back into failure. Relabel the action "Sign out & sign in" and spell
out the sign-out step in the hint.

Co-authored-by: Tony Antunez <57689194+smtony@users.noreply.github.com>

apps/desktop/src/components/boot-failure-overlay.tsx

@@ -153,10 +153,12 @@ export function BootFailureOverlay() {
     setBusy(null)
   }
 
-  // Open the gateway's login window (username/password form or OAuth redirect —
-  // the desktop drives both). On a successful sign-in the session cookie is
-  // re-established in the persistent partition; reload so boot re-runs and the
-  // reconnect mints a ticket against a live session.
+  // Clear the OAuth partition first, then open the gateway's login window
+  // (username/password form or OAuth redirect — the desktop drives both). A
+  // partition-wide sign-out drops stale gateway AND identity-provider cookies so
+  // an expired session can't silently bounce us back into the same state. On a
+  // successful sign-in the cookie is re-established; reload so boot mints a fresh
+  // ticket against a live session.
   const signInRemote = async () => {
     if (!remoteReauth) {
       return
@@ -165,6 +167,7 @@ export function BootFailureOverlay() {
     setBusy('signin')
 
     try {
+      await window.hermesDesktop?.oauthLogoutConnectionConfig?.()
       const result = await window.hermesDesktop?.oauthLoginConnectionConfig(remoteReauth.url)
 
       if (result?.connected) {
@@ -238,11 +241,11 @@ export function BootFailureOverlay() {
 
   if (remoteReauth) {
     actions = [
-      { key: 'signin', label, onClick: () => void signInRemote(), icon: <LogIn />, busy: 'signin' },
+      { key: 'signin', label: copy.signOutAndSignIn, onClick: () => void signInRemote(), icon: <LogIn />, busy: 'signin' },
       { ...settingsAction, variant: 'secondary' },
       localAction
     ]
-    hint = copy.remoteSignInHint
+    hint = copy.remoteSignInHint(label)
   } else if (remoteFailure) {
     actions = [settingsAction, { ...retryAction, variant: 'secondary' }, localAction]
     hint = copy.remoteFailureHint

apps/desktop/src/i18n/en.ts

@@ -94,7 +94,9 @@ export const en: Translations = {
       back: 'Back',
       openLogs: 'Open logs',
       repairHint: 'Repair re-runs the installer and can take a few minutes on a fresh machine.',
-      remoteSignInHint: 'Opens the gateway login window. Use local gateway to switch to the bundled backend instead.',
+      remoteSignInHint: signInLabel =>
+        `Signs out of the saved remote browser session, then opens ${signInLabel}. Use local gateway to switch to the bundled backend instead.`,
+      signOutAndSignIn: 'Sign out & sign in',
       remoteFailureHint: 'Check the gateway URL and sign-in under Gateway settings, or switch to the local gateway.',
       hideRecentLogs: 'Hide recent logs',
       showRecentLogs: 'Show recent logs',

apps/desktop/src/i18n/ja.ts

@@ -94,8 +94,9 @@ export const ja = defineLocale({
       back: '戻る',
       openLogs: 'ログを開く',
       repairHint: '修復はインストーラーを再実行します。新しいマシンでは数分かかる場合があります。',
-      remoteSignInHint:
-        'ゲートウェイのログインウィンドウを開きます。代わりにバンドルされたバックエンドに切り替えるには「ローカルゲートウェイを使用」を選択してください。',
+      remoteSignInHint: signInLabel =>
+        `保存済みのリモートブラウザセッションからサインアウトし、${signInLabel}を開きます。代わりにバンドルされたバックエンドに切り替えるには「ローカルゲートウェイを使用」を選択してください。`,
+      signOutAndSignIn: 'サインアウトして再サインイン',
       remoteFailureHint: '「ゲートウェイ設定」でゲートウェイの URL とサインインを確認するか、ローカルゲートウェイに切り替えてください。',
       hideRecentLogs: '最近のログを非表示',
       showRecentLogs: '最近のログを表示',

apps/desktop/src/i18n/types.ts

@@ -137,7 +137,8 @@ export interface Translations {
       back: string
       openLogs: string
       repairHint: string
-      remoteSignInHint: string
+      remoteSignInHint: (signInLabel: string) => string
+      signOutAndSignIn: string
       remoteFailureHint: string
       hideRecentLogs: string
       showRecentLogs: string

apps/desktop/src/i18n/zh-hant.ts

@@ -92,7 +92,9 @@ export const zhHant = defineLocale({
       back: '返回',
       openLogs: '開啟記錄',
       repairHint: '修復會重新執行安裝程式，在新機器上可能需要幾分鐘。',
-      remoteSignInHint: '開啟閘道登入視窗。使用本機閘道可切換至內建後端。',
+      remoteSignInHint: signInLabel =>
+        `先登出已儲存的遠端瀏覽器工作階段，然後開啟${signInLabel}。使用本機閘道可切換至內建後端。`,
+      signOutAndSignIn: '登出並重新登入',
       remoteFailureHint: '在「閘道設定」中檢查閘道 URL 與登入，或切換至本機閘道。',
       hideRecentLogs: '隱藏最近記錄',
       showRecentLogs: '顯示最近記錄',

apps/desktop/src/i18n/zh.ts

@@ -92,7 +92,9 @@ export const zh: Translations = {
       back: '返回',
       openLogs: '打开日志',
       repairHint: '修复会重新运行安装器，在新机器上可能需要几分钟。',
-      remoteSignInHint: '打开网关登录窗口。也可以使用本地网关切换到随应用提供的后端。',
+      remoteSignInHint: signInLabel =>
+        `先退出已保存的远程浏览器会话，然后打开${signInLabel}。也可以使用本地网关切换到随应用提供的后端。`,
+      signOutAndSignIn: '退出并重新登录',
       remoteFailureHint: '在“网关设置”中检查网关 URL 和登录，或切换到本地网关。',
       hideRecentLogs: '隐藏最近日志',
       showRecentLogs: '显示最近日志',