feat(worker,ui): Online Inbox config + auth hub plumbing (Phase 2)

Hub: GetOnlineInboxState / SetOnlineInboxConfig / SetOnlineInboxAuth /
ClearOnlineInboxAuth. WorkerConfig.SaveOnlineInbox persists only the
online_inbox section. OnlineTokenStore + config registered always so hub
methods work when sync is disabled. IWorkerClient surface + all test fakes
synced. RedirectUri config (default http://localhost:8765/callback).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/ClaudeDo.Worker/Hub/WorkerHub.cs

@@ -4,7 +4,9 @@ using ClaudeDo.Data;
 using ClaudeDo.Data.Models;
 using ClaudeDo.Data.Repositories;
 using ClaudeDo.Worker.Agents;
+using ClaudeDo.Worker.Config;
 using ClaudeDo.Worker.Lifecycle;
+using ClaudeDo.Worker.Online;
 using ClaudeDo.Worker.Planning;
 using ClaudeDo.Worker.Prime;
 using ClaudeDo.Worker.Queue;
@@ -65,6 +67,24 @@ public record UpdateTaskAgentSettingsDto(string TaskId, string? Model, string? S
 public record ListConfigDto(string? Model, string? SystemPrompt, string? AgentPath, int? MaxTurns = null);
 public record SeedResultDto(int Copied, int Skipped);
 
+public record OnlineInboxStateDto(
+    bool Enabled,
+    string ApiBaseUrl,
+    string Authority,
+    string ClientId,
+    string Scopes,
+    string RedirectUri,
+    bool SignedIn);
+
+public record OnlineInboxConfigInput(
+    bool Enabled,
+    string ApiBaseUrl,
+    int PollIntervalSeconds,
+    string Authority,
+    string ClientId,
+    string Scopes,
+    string RedirectUri);
+
 public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
 {
     private static readonly string Version =
@@ -89,6 +109,9 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
     private readonly ITaskStateService _state;
     private readonly IWeekReportService _report;
     private readonly IRefineRunner _refineRunner;
+    private readonly WorkerConfig _cfg;
+    private readonly OnlineInboxConfig _onlineInboxConfig;
+    private readonly OnlineTokenStore _onlineTokenStore;
 
     public WorkerHub(
         QueueService queue,
@@ -109,7 +132,10 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
         IPrimeRunner primeRunner,
         ITaskStateService state,
         IWeekReportService report,
-        IRefineRunner refineRunner)
+        IRefineRunner refineRunner,
+        WorkerConfig cfg,
+        OnlineInboxConfig onlineInboxConfig,
+        OnlineTokenStore onlineTokenStore)
     {
         _queue = queue;
         _waker = waker;
@@ -130,6 +156,9 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
         _state = state;
         _report = report;
         _refineRunner = refineRunner;
+        _cfg = cfg;
+        _onlineInboxConfig = onlineInboxConfig;
+        _onlineTokenStore = onlineTokenStore;
     }
 
     // Maps the two exceptions service methods throw into client-facing HubExceptions:
@@ -684,4 +713,41 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
 
         return ids.Count;
     }
+
+#pragma warning disable CA1416 // ClaudeDo.Worker is Windows-only; DPAPI calls are safe here.
+    public OnlineInboxStateDto GetOnlineInboxState()
+    {
+        var signedIn = _onlineTokenStore.Read() is not null;
+        return new OnlineInboxStateDto(
+            _onlineInboxConfig.Enabled,
+            _onlineInboxConfig.ApiBaseUrl,
+            _onlineInboxConfig.Zitadel.Authority,
+            _onlineInboxConfig.Zitadel.ClientId,
+            _onlineInboxConfig.Zitadel.Scopes,
+            _onlineInboxConfig.RedirectUri,
+            signedIn);
+    }
+
+    public void SetOnlineInboxConfig(OnlineInboxConfigInput input)
+    {
+        _onlineInboxConfig.Enabled = input.Enabled;
+        _onlineInboxConfig.ApiBaseUrl = input.ApiBaseUrl ?? "";
+        _onlineInboxConfig.PollIntervalSeconds = input.PollIntervalSeconds;
+        _onlineInboxConfig.RedirectUri = input.RedirectUri ?? "http://localhost:8765/callback";
+        _onlineInboxConfig.Zitadel.Authority = input.Authority ?? "";
+        _onlineInboxConfig.Zitadel.ClientId = input.ClientId ?? "";
+        _onlineInboxConfig.Zitadel.Scopes = input.Scopes ?? "openid offline_access";
+        _cfg.SaveOnlineInbox();
+    }
+
+    public void SetOnlineInboxAuth(string refreshToken)
+    {
+        _onlineTokenStore.Save(refreshToken);
+    }
+
+    public void ClearOnlineInboxAuth()
+    {
+        _onlineTokenStore.Clear();
+    }
+#pragma warning restore CA1416
 }