0.7: Complete desktop image/cache and OAuth/grant flows #306

Parent: #289. Inspect source: #291.

Work boundary 8/13 from the approved 0.7 → clients → Inspect sequence.

Dependencies: #304, #305.

List permitted images and compatibility, distinguish cached/downloadable state, support pull/create and cache controls, expose OAuth connections and explicit session grants.

Acceptance criteria:

• Browser flows cover ready/downloadable/incompatible images and service errors.
• OAuth connect/refresh/disconnect and session grants work through the gateway.
• Rebuilt desktop binary reflects and proves the UI changes.

Planned PR boundaries: Image/cache UI and credential/grant UI can be separate PRs.

Implementation progress and evidence: Sprinty in the isolated integration/0.7-clients-inspect worktree. Focused tests during development; fast checks/Citadel per PR; relevant black-box proof for runtime, credential or image boundaries. Respect the active release and machine locks.