fix: external links in desktop app - context menu and open behavior (#716)

* fix: allow native context menu on links in chat messages

The desktop app was blocking the context menu on all elements except
specific allowlisted ones (terminal, input, textarea, etc.). This
prevented users from right-clicking on HTTP links in chat messages
to access the 'Open Link' option.

Added 'a' (anchor) tag to the allowlist to restore native context
menu functionality for links.

Fixes #708

* fix: use tauri.shell.open for external links in desktop app

- Add global window.open override to init_script that routes HTTP/HTTPS
  URLs through tauri.shell.open() instead of window.open()
- Add openExternalUrl utility that prefers tauri.shell.open with window.open fallback
- Add openExternalUrl to MarkdownRenderer for link safety.onLinkCheck
- Replace window.open with openExternalUrl in ProvidersPage for OAuth URLs

Fixes #708

* fix: unify external link opening across desktop and UI

Added a shared URL opener that only allows http/https links.
Replaced duplicated Tauri/window link-open logic in key UI sections.
Removed fragile desktop window.open override and markdown external-link modal behavior.

---------

Co-authored-by: Bohdan Triapitsyn <artmore@protonmail.com>

packages/ui/src/lib/url.ts

@@ -0,0 +1,74 @@
+/**
+ * Utility for opening external URLs with Tauri shell support.
+ * In desktop runtime, uses tauri.shell.open() for proper system browser handling.
+ * Falls back to window.open() for web runtime.
+ */
+
+type TauriShell = {
+  shell?: {
+    open?: (url: string) => Promise<unknown>;
+  };
+};
+
+const parseUrlSafely = (value: string): URL | null => {
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+};
+
+export const isExternalHttpUrl = (url: string): boolean => {
+  const parsed = parseUrlSafely(url.trim());
+  if (!parsed) {
+    return false;
+  }
+  return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+};
+
+/**
+ * Opens an external URL in the system browser.
+ * In Tauri desktop runtime, uses tauri.shell.open() for proper handling.
+ * Falls back to window.open() for web runtime.
+ *
+ * @param url - The URL to open
+ * @returns Promise<boolean> - true if the URL was opened successfully
+ */
+export const openExternalUrl = async (url: string): Promise<boolean> => {
+  if (typeof window === 'undefined') {
+    return false;
+  }
+
+  const target = url.trim();
+  if (!target) {
+    return false;
+  }
+
+  const parsed = parseUrlSafely(target);
+  if (!parsed) {
+    return false;
+  }
+
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    return false;
+  }
+
+  const normalizedTarget = parsed.toString();
+
+  const tauri = (window as unknown as { __TAURI__?: TauriShell }).__TAURI__;
+  if (tauri?.shell?.open) {
+    try {
+      await tauri.shell.open(normalizedTarget);
+      return true;
+    } catch {
+      // Fall through to window.open
+    }
+  }
+
+  try {
+    window.open(normalizedTarget, '_blank', 'noopener,noreferrer');
+    return true;
+  } catch {
+    return false;
+  }
+};