feat(settings): thread service through oauth_flow_begin webchannel

[vbudhram]

Because

• fxaccounts:oauth_flow_begin carries no service in either direction. FxA rebuilds the sign-in URL and hardcodes service=sync.
• Every caller today is a Sync flow, so that literal is correct. A future FxA-initiated non-Sync flow would become a Sync sign-in with no error.
• This is hardening, not a bug fix. No current caller changes behaviour.

This pull request

• Adds an optional service argument to fxaOAuthFlowBegin. The payload sends it with the scopes, and omits the key when the caller passes none.
• Renames buildSyncOAuthSearch to buildOAuthSearch. It takes the service from the caller, then the browser echo, then falls back to sync.
• Adds WebChannelService, derived from the WebChannelServices keys. A runtime set rejects an echo that is not one of the four names.
• Passes sync explicitly from Pair/Index and ConnectAnotherDevice, and adds a CAD test that asserts the resulting URL.
• Leaves useOAuthFlowRecovery alone. It still preserves the params already in the URL.

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-14371

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: firefox.ts. Look at the precedence chain in buildOAuthSearch and the payload in fxaOAuthFlowBegin.
• Suggested review order: firefox.ts, then firefox.test.ts, then the two call sites.
• Risky or complex parts: the echo path. The caller argument wins the chain, so pairing and CAD still produce service=sync whatever the browser sends.

Screenshots (Optional)

No user interface change.

Other information (Optional)

• packages/fxa-settings unit tests: 3305 passed, 0 failed. nx lint fxa-settings: 0 errors.
• The ticket names models/integrations/oauth-native-integration.ts for getWebChannelServices. It is declared in models/integrations/integration.ts and overridden in oauth-native-integration.ts.
• packages/functional-tests/lib/channels.ts needed no edit. It already types the mocked browser response as FxAOAuthFlowBeginResponse, so the new field flows through.
• The browser-side echo is out of scope and needs a Bugzilla bug. Nothing depends on the echo, so the response field is optional and the FxA half lands on its own.

[Copilot]

Pull request overview

Threads OAuth service identity through Firefox WebChannel flow startup while preserving Sync defaults and validating browser echoes.

Changes:

• Adds typed service payloads and validated precedence handling.
• Updates Pair and Connect Another Device to pass sync.
• Expands unit and navigation coverage.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pages/Pair/Index/index.tsx	Passes Sync service through pairing bootstrap.
pages/Pair/Index/index.test.tsx	Verifies the service argument.
pages/ConnectAnotherDevice/index.tsx	Preserves Sync service during sign-in.
pages/ConnectAnotherDevice/index.test.tsx	Tests the generated Sync URL.
lib/channels/firefox.ts	Adds service typing, validation, and WebChannel payload support.
lib/channels/firefox.test.ts	Tests service precedence, validation, and payload omission.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.