Cancel subscription sign-in requests when leaving agent setup (#19610)

Back during pending subscription sign-in could accept a late response and
reopen agent setup. Abort pending reads, release abandoned sessions, and
ignore stale responses. Wait for cleanup before starting a replacement,
and preserve sessions belonging to another account or environment.

Cover deferred resume/start/prompt responses for both providers, local
login cancellation, quick reselection, and browser request abort. Stabilize
Runner fixtures and normalization assertions exposed by integration CI.

Verified: 483 focused UI tests, six onboarding browser cases, UI typecheck
and token gates, Runner fixture checks, and the complete CI run on
221f2e3eb7. Greptile scored 5/5;
all review threads are resolved. Earlier failures and recovery evidence
remain in the PR description.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

ui/src/api/agents.ts

@@ -338,18 +338,18 @@ export const agentsApi = {
   // The owner response repeats the live prompt on every read while the
   // session holds an active public status, so this polling call carries the
   // same no-store request option as the active-session read below.
-  getAdapterAuthLoginStatus: (companyId: string, type: string, sessionId: string) =>
+  getAdapterAuthLoginStatus: (companyId: string, type: string, sessionId: string, options?: { signal?: AbortSignal }) =>
     api.get<AdapterAuthSessionOwnerResponse>(
       `/companies/${encodeURIComponent(companyId)}/adapters/${encodeURIComponent(type)}/login-sessions/${encodeURIComponent(sessionId)}`,
-      { cache: "no-store" },
+      { cache: "no-store", ...options },
     ),
   // Reads the caller's active login session for one company and adapter, with
   // no session id, so the browser rediscovers its own session after a reload
   // with no local state. A 404 means no active session for the caller.
-  getActiveAdapterAuthLoginSession: (companyId: string, type: string) =>
+  getActiveAdapterAuthLoginSession: (companyId: string, type: string, options?: { signal?: AbortSignal; fresh?: boolean }) =>
     api.get<AdapterAuthSessionOwnerResponse>(
       `/companies/${encodeURIComponent(companyId)}/adapters/${encodeURIComponent(type)}/login-sessions/active`,
-      { cache: "no-store" },
+      { cache: "no-store", ...options },
     ),
   cancelAdapterAuthLogin: (companyId: string, type: string, sessionId: string) =>
     api.post<AdapterAuthSessionOwnerResponse>(
@@ -378,21 +378,23 @@ export const agentsApi = {
       `/companies/${encodeURIComponent(companyId)}/setup-token-login-sessions`,
       { adapterType: "claude_local", ...data },
     ),
-  getClaudeSetupTokenLoginStatus: (companyId: string, sessionId: string) =>
+  getClaudeSetupTokenLoginStatus: (companyId: string, sessionId: string, options?: { signal?: AbortSignal }) =>
     api.get<ClaudeSetupTokenSessionResponse>(
       `/companies/${encodeURIComponent(companyId)}/setup-token-login-sessions/${encodeURIComponent(sessionId)}`,
+      options,
     ),
   // Reads the caller's active Claude setup-token login session, with no
   // session id, so the browser rediscovers its own session after a reload with
   // no local state. A 404 means no active session for the caller.
-  getActiveClaudeSetupTokenLoginSession: (companyId: string) =>
+  getActiveClaudeSetupTokenLoginSession: (companyId: string, options?: { signal?: AbortSignal; fresh?: boolean }) =>
     api.get<ClaudeSetupTokenSessionOwnerResponse>(
       `/companies/${encodeURIComponent(companyId)}/setup-token-login-sessions/active`,
-      { cache: "no-store" },
+      { cache: "no-store", ...options },
     ),
-  getClaudeSetupTokenLoginPrompt: (companyId: string, sessionId: string) =>
+  getClaudeSetupTokenLoginPrompt: (companyId: string, sessionId: string, options?: { signal?: AbortSignal }) =>
     api.get<ClaudeSetupTokenSessionPrompt>(
       `/companies/${encodeURIComponent(companyId)}/setup-token-login-sessions/${encodeURIComponent(sessionId)}/prompt`,
+      options,
     ),
   submitClaudeSetupTokenBrowserCode: (companyId: string, sessionId: string, browserCode: string) =>
     api.post<ClaudeSetupTokenSessionResponse>(