fix(oauth): keep open external so xAI/Grok token refresh works on Windows

`open` derives its own directory from import.meta.url at module scope.
Webpack replaces that with the build machine's absolute path as a
string literal, so a release built on macOS ships a file:///Users/...
URL that fileURLToPath rejects on Windows (no drive letter), throwing
on import. refreshXaiToken dynamic-imports the xAI OAuth service, which
imports open eagerly, so every Grok token refresh silently failed and
was swallowed by a catch that only logs a warning.

Add open to serverExternalPackages so it keeps its real import.meta.url
at runtime, and bundle it into the CLI package via ensureModuleInBundle
(same guard already used for sql.js) since externalizing it means
webpack no longer traces/copies it automatically.

cli/scripts/build-cli.js

@@ -195,6 +195,10 @@ function ensureModuleInBundle(pkg) {
   console.log(`✅ Bundled ${pkg}`);
 }
 ensureModuleInBundle("sql.js");
+// `open` is external (see serverExternalPackages in next.config.mjs), so it must exist in
+// the bundle's node_modules or every importer throws MODULE_NOT_FOUND at runtime. Output
+// tracing normally copies it; this is the same belt-and-braces guard used for sql.js.
+ensureModuleInBundle("open");
 const betterDir = path.join(cliAppDir, "node_modules", "better-sqlite3");
 if (fs.existsSync(betterDir)) {
   fs.rmSync(betterDir, { recursive: true, force: true });