fix(ui): surface Plus OAuth credential diagnostics in Add Account dialog

When POST /api/cliproxy/auth/:provider/start-url returns 400
plus_oauth_credentials_missing or 502 plus_oauth_url_missing_client_id,
surface the server-provided human-readable message (env var names and
backend=original switch hint) instead of the raw error code. Error
propagates through the existing toast/inline-alert path in
add-account-dialog.tsx — no new component primitives.

Refs #1208

ui/src/hooks/use-cliproxy-auth-flow.ts

@@ -371,8 +371,17 @@ export function useCliproxyAuthFlow() {
           const success = data.success === true;
 
           if (!response.ok || !success) {
+            // For Plus OAuth credential errors the server sends a human-readable
+            // explanation in `data.message`; prefer it over the machine error code.
+            const isPlusCredentialError =
+              data.error === 'plus_oauth_credentials_missing' ||
+              data.error === 'plus_oauth_url_missing_client_id';
             const errorMsg =
-              typeof data.error === 'string' ? data.error : t('toasts.providerStartOAuthFailed');
+              isPlusCredentialError && typeof data.message === 'string'
+                ? data.message
+                : typeof data.error === 'string'
+                  ? data.error
+                  : t('toasts.providerStartOAuthFailed');
             throw new Error(errorMsg);
           }