The current `afx tower connect` opens the browser to the registration page and prompts "Paste registration token from browser" — a copy-paste round trip. The Codev Cloud service is adding a device-authorization flow; consume it.
Scope
- `afx tower connect` gains the device flow (ideally as the new default; `--token` legacy path kept for one release): print/open confirm URL + user code → poll → receive tower credentials → write `~/.agent-farm/cloud-config.json` exactly as today (`ctk_` key, 0600 perms, same schema — downstream consumers unchanged).
- Keep the device-flow client shareable with the VS Code extension's AuthenticationProvider if practical (one implementation of endpoint paths + backoff).
- `afx tower status` continues to reflect cloud/tunnel state (the extension UI will consume it).
Acceptance
- Fresh machine → `afx tower connect` → browser confirm → connected, zero manual token handling; re-register and `--service-url` staging override still work.
The current `afx tower connect` opens the browser to the registration page and prompts "Paste registration token from browser" — a copy-paste round trip. The Codev Cloud service is adding a device-authorization flow; consume it.
Scope
Acceptance