Add account indicator to mobile titlebar in agents workbench (#312437)

* Add account indicator to mobile titlebar in agents workbench

The mobile titlebar now shows a contextual right slot:
- Welcome / new session screen: [☰] [title] [account]
- In a chat session: [☰] [title] [+]

The account indicator mirrors the desktop titlebar account widget:
- Shows GitHub avatar when signed in, codicon fallback otherwise
- Displays dot badge for quota warnings/errors
- Tapping opens a panel with account info, copilot status dashboard,
  and sign-in/sign-out actions
- Touch-friendly: 44px minimum touch targets, touch-action: manipulation

Also extracts the AccountMenu MenuId to Menus.AccountMenu for sharing
between the desktop and mobile implementations.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix account panel immediately dismissing on mobile tap

The hover service registers a document-level mousedown listener for
sticky hovers that dismisses the hover when clicking outside it. On
mobile, the mousedown fires in the same event cycle as the click that
opens the panel, so the hover was created and then immediately
dismissed.

Defer the showInstantHover call to the next animation frame so the
mousedown event has completed before the sticky listener is registered.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Use DOM overlay for mobile account panel instead of hover service

The hover service's sticky mousedown/mouseout handling doesn't work
reliably on mobile touch devices. Replace it with a simple DOM overlay
pattern: a full-screen backdrop that catches taps to dismiss, with the
panel absolutely positioned below the top bar.

This is more appropriate for mobile UX — touch interactions work
natively without fighting the desktop hover infrastructure.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix account panel styling by appending inside workbench container

The panel was appended to document.body, outside the
.agent-sessions-workbench container, so none of the existing
.sessions-account-titlebar-panel-* CSS selectors matched.

Append the backdrop and panel inside the workbench container so
the desktop panel styles (header, actions, dashboard, separators)
apply correctly on mobile.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Redesign mobile account panel as full-screen bottom sheet

Replace the desktop-style dropdown with a native mobile bottom sheet:

- Full-screen sheet with header (title + close button)
- Profile section with large avatar + name + provider
- Copilot status dashboard when signed in
- Large touch-friendly action rows (52px height, 16px font)
  with icons for Sign In/Out and Settings
- Proper safe area insets for notched devices
- Scrollable content area with overscroll containment
- All new CSS classes (mobile-account-sheet-*) purpose-built
  for mobile — no reuse of desktop hover panel styles

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix scopeListOrRequest is not iterable in signIn

When product.json defaultChatAgent.providerScopes is empty,
scopes[0] evaluates to undefined. The spread in createSession
then fails with is not iterable. Default to an empty array.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add OAuth callback support to sessions web dev server

The sessions dev server was missing two things needed for GitHub
OAuth sign-in to work:

1. A /callback route serving the OAuth redirect page (callback.html)
   that writes the auth code to localStorage
2. A urlCallbackProvider passed to the workbench create() options
   that polls localStorage for the auth code and delivers it back
   to the GitHub authentication extension

Without these, the OAuth flow would complete on GitHub's side but
the auth code was never delivered back to the workbench.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Revert "Add OAuth callback support to sessions web dev server"

This reverts commit 4034dd5b0b8add4e94e47c38c08ee0fcb22ffcfe.

* Fix web walkthrough auth scope mismatch and token expiry

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Use product config scopes for walkthrough sign-in instead of hardcoded

The previous fix used defaultAccountService.signIn() which blocks on
the init barrier — the DefaultAccountProvider may not be set yet when
the walkthrough runs on first launch.

Instead, keep using authenticationService.createSession() directly
(which doesn't depend on the provider lifecycle) but read the scopes
from productService.defaultChatAgent.providerScopes[0] instead of
hardcoding ['repo', 'user:email', 'read:user']. This ensures the
session has the 'workflow' scope that the account provider needs
while avoiding the provider initialization race.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add fallback scopes when product config is unavailable

If productService.defaultChatAgent.providerScopes is undefined (e.g.
in vscode-dev web context where product config may not include it),
fall back to the full scope set including workflow. Without this, an
empty scopes array would create a session that the tunnel discovery
code cannot find (it filters for user:email).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Listen to auth session changes directly for mobile account indicator

The mobile account indicator relied solely on
defaultAccountService.onDidChangeDefaultAccount, which depends on
the DefaultAccountProvider completing its async initialization
(extension registration, entitlement resolution). On mobile web,
the walkthrough sign-in creates the session before the provider
is fully initialized, so the event is missed.

Also listen to authenticationService.onDidChangeSessions to pick up
new GitHub sessions immediately when they're created, regardless of
the DefaultAccountProvider lifecycle.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix account indicator showing Sign In after walkthrough on localhost

Two fixes for the mobile account indicator not reflecting auth state
after the walkthrough completes:

1. Fall back to reading GitHub sessions directly from
   IAuthenticationService when DefaultAccountService returns null.
   This covers the window between session creation (walkthrough) and
   DefaultAccountProvider initialization (extension registration).

2. When we have an account name from auth sessions but entitlement is
   still Unknown (not yet resolved), treat it as Unresolved rather
   than Unknown. This prevents getAccountTitleBarState() from
   returning 'Agents Signed Out' when the user is actually signed in
   but the entitlement service hasn't caught up yet.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Hide Copilot setup dashboard in mobile account sheet when unresolved

The ChatStatusDashboard shows 'Set up Copilot to use AI features'
when the entitlement is Unknown or Available (new user). This setup
flow doesn't apply in the agents app which has its own walkthrough.

Only show the dashboard when entitlements have fully resolved to a
known plan (Free, Pro, etc). When still resolving, the profile
section already shows the account name which is sufficient.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Apply same auth state fixes to desktop TitleBarAccountWidget

The desktop account widget had the same issue as the mobile one:
after walkthrough sign-in, it showed 'Agents Signed Out' because
the DefaultAccountProvider hadn't initialized yet.

Apply the same three fixes from the mobile indicator:
1. Listen to authenticationService.onDidChangeSessions directly
2. Fall back to reading GitHub sessions when defaultAccountService
   returns null
3. Override Unknown -> Unresolved when an account name is present
   to prevent showing signed-out state during entitlement resolution

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add INFO-level logging to DefaultAccountProvider for debugging

Upgrade key log messages from debug to info level to trace the
account resolution flow in the browser console:
- Session count and matching results in findMatchingProviderSession
- Account name and scopes when sessions are found
- Final account state after initialization completes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Use console.log for DefaultAccount debug logging

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Accept any session when providerScopes is empty

On vscode.dev the product config may not include providerScopes,
resulting in an empty allScopes array. The scope matching loop
never executes, so no sessions match even though valid sessions
exist. When no scopes are configured, accept any available session.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Hide 'Use AI Features' button when AI features are disabled

When users disable AI features via chat.disableAIFeatures, the account
section in the Agents window should not show the 'Set up Copilot to use
AI features' button. This change checks sentiment.hidden in addition to
the other disabled states to properly hide this UI element.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Hide Copilot setup dashboard in desktop account panel when unresolved

Same fix as the mobile account sheet — don't show the
ChatStatusDashboard when entitlement is Unknown or Available,
as it renders a 'Set up Copilot to use AI features' prompt
that doesn't apply in the agents app.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Update

* Clean up

Co-authored-by: Copilot <copilot@github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <copilot@github.com>