kcap setup: create-tenant flow hangs at 'Provisioning…' and never completes #258

Summary

During kcap setup with WorkOS org SSO, when no tenant exists yet the CLI offers to create one, provisions it, then polls for it to go live. The poll never completes even after the tenant is provisioned and live — the spinner sits at "Provisioning {slug}.kcap.ai…" until it times out (~10 min), and no profile is saved.

Root cause

The poll reuses a single org-less WorkOS access token for the entire ~10-minute wait, but WorkOS AuthKit access tokens live only ~5 minutes. Once it expires the signup server returns 401 for every GET /api/signup/status, and the client swallowed any non-2xx to a null "still provisioning", so the CLI spun silently until timeout — even though the tenant went live.

Contributing defects in the same poll:

• GetStatusAsync collapsed 401/403/404/transport-error all to null, indistinguishable from "still provisioning" — zero diagnostics.
• An active row without workosOrgId (which the server contract explicitly allows) was treated as not-done, another infinite-spin path.

Fix

• WorkOSTokenSource: refreshes the access token (public-client refresh_token grant) before it lapses so every status call carries a live token. Handles WorkOS single-use refresh-token rotation so the final org-switch uses the rotated token.
• GetStatusAsync surfaces the HTTP status; the poll classifies each outcome (ProvisioningPoll.Classify) and prints clear terminal messages for 403/404/failed/active-without-org instead of spinning; the spinner now shows liveness per attempt.

Found while manually testing the onboarding flow.