feat: implement OAuth PKCE browser login

Implements #7 - OAuth PKCE flow for browser-based authentication.

New files:
- src/lib/pkce.ts - PKCE utilities (code verifier, challenge, state)
- src/lib/oauth-server.ts - Local HTTP callback server
- src/lib/oauth.ts - OAuth URL builder and token exchange

Changes:
- ol auth login now opens browser for OAuth authorization
- ol auth login --token preserved for manual API token auth
- Client ID configurable via OUTLINE_OAUTH_CLIENT_ID env or prompt
- Client ID persisted in config for future logins

Flow:
1. Generate PKCE code_verifier + code_challenge + state
2. Start local callback server on localhost
3. Open browser to authorize endpoint
4. Receive callback with auth code
5. Exchange code for access token
6. Save token to config

Note: Requires user to register a public OAuth app in Outline settings.
Blocked by outline/outline#11254 (HTTPS redirect URI requirement).

Author: Ubuntu

package.json

@@ -26,6 +26,7 @@
 		"commander": "14.0.2",
 		"marked": "15.0.12",
 		"marked-terminal": "7.3.0",
+		"open": "10.2.0",
 		"yocto-spinner": "1.0.0"
 	},
 	"devDependencies": {