feat(auth): add OAuth device login

[ivankuznetsov]

Summary

Headless Screenote users can now sign in from SSH, tmux, containers, and remote agents with screenote login --device, without opening a browser or forwarding a callback port. The existing browser-based PKCE login remains the default for interactive machines.

The CLI treats the device credential as a secret throughout the flow: it emits only a safe JSON authorization prompt, follows RFC polling and slow_down behavior, bounds in-flight requests by the grant expiry, and redacts raw or escaped device codes from terminal failures. Successful OAuth login also replaces a legacy token stored in the config file so old onboarding cannot silently override the new refreshable session; explicit compatibility flags remain accepted but hidden from help.

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• gofmt and diff checks
• Exercised a real CLI-to-Rails flow: browser approval saved OAuth credentials and listed the authenticated project; browser denial returned access_denied without storing credentials.

New concepts

OAuth device authorization grant

Device authorization separates the terminal that requests access from the browser where the user approves it. That makes it a better fit than a loopback callback when the CLI runs on a remote machine with no reachable browser port.

flowchart TB
  CLI[Headless CLI] -->|request device and user codes| Server[Screenote OAuth server]
  CLI -->|show safe URL and short code| User[User]
  User -->|approve in any browser| Server
  CLI -->|poll with secret device code| Server
  Server -->|refreshable OAuth credentials| CLI

Loading

The default PKCE login remains preferable when the CLI and browser share a machine because it completes directly and avoids polling. Device authorization is reserved for explicit --device use on remote or browserless hosts.

---