Surface OAuth failures on server selection & support subpath-hosted HA

[adborbas]

Changes

• Render viewModel.errorMessage on ServerSelectionView via an .alert, so a failed OAuth prepare (from a discovered/manually-entered server) or a failed token exchange in handleOAuthCallback is now visible and dismissible instead of silently returning the user to the server list. The alert is gated to present only when no sheet is up.
• ManualEntrySheet keeps its inline validation text and clears errorMessage on disappear so a manual-validation message never leaks into the parent alert. connectAndDismiss only dismisses when the attempt produced no error, so all synchronous manual-entry failures (including a URL that passes field validation but is rejected by OAuth prep) stay visible inline rather than dismissing over an unshown error.
• errorMessage is cleared when opening manual entry (prepareManualEntry).
• OAuthFlowManager.prepare now appends the callback/authorize paths onto the server URL's existing base path instead of overwriting it, so subpath-hosted HA behind a reverse proxy (e.g. https://example.com/ha) builds correct same-origin URLs. Force-unwraps on the runtime URLComponents/URL are replaced with guard let throwing AuthError.invalidServerURL.

Why

Two code-audit findings:

• OAuth/connection failures were surfaced nowhere on the server-selection screen — errorMessage was set on two failure paths but only ever rendered inside the manual-entry sheet, so a failed connect looked like it silently did nothing.
• OAuth authorize/redirect URLs overwrote the server's base path, breaking login for HA instances served under a URL subpath (the app requested https://example.com/auth/authorize instead of https://example.com/ha/auth/authorize).

Notes

• No-base-path URLs remain byte-identical to before; base-path and trailing-slash cases are covered by new OAuthFlowManagerTests.
• New view-model tests cover the OAuth-callback failure surfacing, stale-error clearing, and the "returns true but sets error" contract that connectAndDismiss relies on.
• Demo mode is unaffected (the OAuth flow is bypassed via "Try Demo").
• Not reproducible in demo/simulator without a live HA server; verified via clean build + HemeraTests (all green).