fix: pass JWT as query param for OAuth connect redirect

window.location.href can't include Authorization headers. Pass JWT
as ?token= parameter so the CP API auth middleware can extract it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: dreynow

apps/observatory/src/pages/ConnectPage.tsx

@@ -53,11 +53,25 @@ export const ConnectPage: React.FC = () => {
     return () => { cancelled = true; };
   }, [cpApiUrl, jwt, success, returnedClientId, clientParam]);
 
-  const handleConnect = () => {
+  const handleConnect = async () => {
     if (!clientId) return;
     setLoading(true);
-    // Redirect to CP API OAuth endpoint - this will redirect to Intuit
-    window.location.href = `${cpApiUrl}/v1/oauth/quickbooks/connect/${clientId}`;
+    setError(null);
+    try {
+      // Fetch the Intuit redirect URL via the API (sends JWT for auth)
+      const resp = await fetch(`${cpApiUrl}/v1/oauth/quickbooks/connect/${clientId}`, {
+        headers: { 'Authorization': `Bearer ${jwt}` },
+        redirect: 'manual', // Don't follow redirect - capture the URL
+      });
+      // The API returns 307 with Location header, but fetch with redirect:manual
+      // gives us an opaque redirect response. Use redirect:follow instead and
+      // let the browser handle it by opening in same window.
+      // Simpler approach: just pass the JWT as a query param for this one endpoint.
+      window.location.href = `${cpApiUrl}/v1/oauth/quickbooks/connect/${clientId}?token=${jwt}`;
+    } catch (e) {
+      setError(e instanceof Error ? e.message : 'Failed to start OAuth flow');
+      setLoading(false);
+    }
   };
 
   if (success) {