Render provider authentication and model selection in the web client

[Haz3-jolt]

Outcome

Add provider authentication, catalog refresh, model selection, switching, and status to the planned web client as a projection over the public SDK.

Current repository evidence

The planned packages/web presentation package does not exist. Current provider UI is Azure-specific terminal wiring, so a browser has no provider-aware projection to reuse.

Acceptance criteria

• Render every provider-management capability granted to the browser principal from shared SDK state, including grouped models, capability data, availability, and safe authentication state.
• Submit login, cancellation, logout, refresh, provider/model selection, and role configuration through authenticated typed SDK operations only.
• Keep model-provider credentials out of browser state, HTML, diagnostics, and cursor storage; transport authentication remains a separate platform adapter concern.
• Show unsupported or unauthorized operations explicitly and never simulate missing daemon behavior.
• Add planned web tests for multiple providers, authorization, login cancellation, regional identities, switching, reconnect, redaction, and cross-client convergence.

Verification

Run the planned web tests and shared client conformance suite against a local gateway and fake providers. This audit did not run tests.

Coordination

Any packages/web/... path is planned. #273 owns daemon and SDK behavior, and the web package must not depend at runtime on AI, daemon, runtime, kernel, or sandbox packages.

Source

ROADMAP.md Product vision §2.7, §15.5, and §16.2; Technical implementation roadmap, Phase 9: Web client. docs/architecture/client-boundaries.md.

Repository audit

Audited against Axl 88944a2. Phase 9. Source inspection, not an executed behavior test. Roadmap references: L1214, L1268, L2111.

Tracking key: axl-backlog:providers.web-provider-management.

Issue tracking

Axl issue mirror: #372 | GitHub #372

Related issues:

• #273 (Expose provider login, catalog, selection, and status through daemon and SDK #273)