fix: allow user plugins to override built-in auth plugins

[JosXa]

Fixes #11475

Change .find() to .findLast() in CLI auth flow so user plugins take precedence over internal plugins (e.g., github-copilot). This aligns CLI behavior with ProviderAuth.methods() which already uses last-wins semantics via fromEntries().

What does this PR do?

Fixes a bug where user/external plugins cannot override built-in auth plugins. The root cause is that Plugin.list() returns internal plugins first, then user plugins. The CLI auth command used .find() (first match wins), meaning the built-in plugin always took precedence. Meanwhile, ProviderAuth.methods() (used by TUI) already used fromEntries() which is last-wins.

This PR changes two .find() calls to .findLast() in packages/opencode/src/cli/cmd/auth.ts so user plugins can fully override built-in auth behavior (e.g., a company plugin replacing the default GitHub Copilot OAuth flow with a custom enterprise auth).

How did you verify your code works?

Added packages/opencode/test/plugin/auth-override.test.ts which:

1. Creates a temp directory with a user plugin that registers auth.provider: "github-copilot" with a custom method
2. Calls ProviderAuth.methods() and asserts the user plugin's method takes precedence over the built-in

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Based on my search, I found one potentially related PR:

feat(auth): merge auth methods from multiple plugins for same provider

This PR appears related because it addresses how auth methods are merged from multiple plugins for the same provider. Your PR (11058) is about ensuring user plugins can override built-in auth plugins, which is related to how multiple plugins providing the same auth method are handled and prioritized.

These PRs may be addressing related or overlapping concerns around plugin precedence and auth method resolution, so it would be worth checking if one approach conflicts with or complements the other.

[rekram1-node]

/review

[rekram1-node]

should we be doing the same here?

[github-actions]

Potential bug: The PR description states that two .find() calls are changed to .findLast(), but only this call (line 310) was updated. Line 326 (const customPlugin = await Plugin.list().then((x) => x.find(...)) still uses .find(), which means custom provider overrides entered via the "other" option will not work as intended. Consider also updating line 326 for consistency with the fix.