feat: implement OAuth PKCE browser login (#20)

* feat: implement OAuth PKCE browser login

Implements #7 - OAuth PKCE flow for browser-based authentication.

New files:
- src/lib/pkce.ts - PKCE utilities (code verifier, challenge, state)
- src/lib/oauth-server.ts - Local HTTP callback server
- src/lib/oauth.ts - OAuth URL builder and token exchange

Changes:
- ol auth login now opens browser for OAuth authorization
- ol auth login --token preserved for manual API token auth
- Client ID configurable via OUTLINE_OAUTH_CLIENT_ID env or prompt
- Client ID persisted in config for future logins

Flow:
1. Generate PKCE code_verifier + code_challenge + state
2. Start local callback server on localhost
3. Open browser to authorize endpoint
4. Receive callback with auth code
5. Exchange code for access token
6. Save token to config

Note: Requires user to register a public OAuth app in Outline settings.
Blocked by outline/outline#11254 (HTTPS redirect URI requirement).

* chore: sync package-lock.json with open dependency

* docs: update README with OAuth login instructions

* fix: address Copilot review feedback

- Handle OAuth error responses (e.g., access_denied) with descriptive messages
- Prevent race condition in server error handler by setting resolved flag

---------

Co-authored-by: Ubuntu <ubuntu@ip-172-31-80-221.ec2.internal>

Author: gnapse

README.md

@@ -14,12 +14,34 @@ npm link
 
 ## Auth
 
+### OAuth login (recommended)
+
 ```sh
-ol auth login     # prompts for API token and base URL
+ol auth login     # opens browser for OAuth authorization
 ol auth status    # show current auth state
 ol auth logout    # clear saved credentials
 ```
 
+**Setup:**
+
+1. Create a public OAuth app in Outline (Settings → Applications)
+2. Set the redirect URI to `http://localhost` (any port is fine)
+3. Run `ol auth login` and enter your OAuth client ID when prompted
+
+The client ID is saved for future logins. You can also set `OUTLINE_OAUTH_CLIENT_ID` env var.
+
+### Manual token login
+
+If you prefer using an API token directly:
+
+```sh
+ol auth login --token <your-api-token>
+```
+
+Generate a token in Outline under Settings → API Tokens.
+
+### Configuration
+
 Token resolution: `OUTLINE_API_TOKEN` env var → `~/.config/outline-cli/config.json`.
 
 Base URL resolution: `OUTLINE_URL` env var → config file → `https://app.getoutline.com`.

package-lock.json

@@ -26,6 +26,7 @@
 		"commander": "14.0.2",
 		"marked": "15.0.12",
 		"marked-terminal": "7.3.0",
+		"open": "10.2.0",
 		"yocto-spinner": "1.0.0"
 	},
 	"devDependencies": {