fix: support paste and safe backspace in OAuth token input

[yeppyworld66]

Problem

1. Pasting tokens doesn't work — in raw mode, pasted text arrives as a multi-char buffer but the old code treated the entire chunk as a single character, so only the first char was processed.
2. Backspace could visually eat the prompt — while the guard existed, the single-char processing meant edge cases with multi-byte sequences could slip through.

Fix

• Iterate each character in the raw stdin chunk (for (const c of str)) so multi-char pastes (Cmd+V / Ctrl+V) are fully processed
• Each pasted char gets its own * mask on screen
• Backspace remains guarded by input.length > 0 — can never delete into the prompt text
• Extracted finish() helper for clean teardown

Testing

• Pasted a 28-char token → 28 *s displayed ✅
• Backspace removes chars correctly ✅
• Backspace stops at prompt boundary ✅
• Enter submits and saves credentials ✅
• yarn build ✅
• yarn test — 31/31 passing ✅