feat(auth): add GitHub-backed human login

[Yacobolo]

Summary

• add GitHub OAuth + PKCE as the human identity proof for the public console and CLI device approval
• keep Autback-owned, independently revocable browser sessions and per-device tokens
• add immutable GitHub identity binding through the administrative CLI
• serve the console on a public domain with ACME TLS while retaining private operation-scoped PKI for CAS and BuildKit
• preserve one-time enrollment as an explicit recovery-only login path
• document and harden existing-host deployment, secret transfer, sign-out, and service URL migration

Verification

• task test
• protobuf v1 compatibility check
• TypeScript tests/typecheck and embedded console build
• Go package suite
• Terraform validation