Fix Console device sign-in opening a doubled /console URL

[grikomsn]

Summary

Console device authorization returns an origin-absolute verification path (/console/device?user_code=...). Sign-in concatenated that onto the Console API base (https://console.opencode.ai), which opened console.opencode.ai/console/... and then 302ed to the doubled opencode.ai/console/console/device route.

The public Console site is https://opencode.ai/console. The console.opencode.ai host 302-prefixes /console, so it is not a safe browser origin for that path.

Parity with opencode-copilot-chat#41, with one extra this repo still needs: rewrite console.opencode.ai device pages onto opencode.ai/console. That host was this provider's documented default, and OPENCODE_CONSOLE_SERVER may still point at it.

• Resolve verification_uri_complete with the URL constructor instead of string concatenation
• Default the API server to https://opencode.ai/console
• Canonicalize console.opencode.ai device pages onto https://opencode.ai/console/device
• Keep the API server used for token polling unchanged
• Treat both public hosts as non-custom in /opencode-console status

Verification

• npm run check
• npm run package
• Live POST https://console.opencode.ai/auth/device/code and POST https://opencode.ai/console/auth/device/code both return verification_uri_complete: "/console/device?user_code=..."
• https://console.opencode.ai/console/device 302s to https://opencode.ai/console/console/device
• https://opencode.ai/console/device returns 200

Checklist

• The change is focused and contains no unrelated churn.
• Tests pass with npm run check.
• Packaging passes with npm run package.
• User-visible changes include a Changeset; otherwise, this is not applicable.
• Relevant documentation is updated; otherwise, this is not applicable.