Co-authored-by: M Atif Ali <atif@coder.com>

Co-authored-by: Bruno Quaresma <bruno@coder.com>
fix: fix size for non-squared app icons (#17663)

Co-authored-by: Bruno Quaresma <bruno@coder.com>
fix: fix windsurf icon on light theme (#17679)

Co-authored-by: Charlie Voiselle <464492+angrycub@users.noreply.github.com>

…ry-pick #17878) (#17961)

Cherry-picked fix: stop extending API key access if OIDC refresh is
available (#17878)

fixes #17070

Cleans up our handling of APIKey expiration and OIDC to keep them
separate concepts. For an OIDC-login APIKey, both the APIKey and OIDC
link must be valid to login. If the OIDC link is expired and we have a
refresh token, we will attempt to refresh.

OIDC refreshes do not have any effect on APIKey expiry.

#17070 (comment)
explains why this is the correct behavior.

Co-authored-by: Spike Curtis <spike@coder.com>