fix(auth): include OAuth resource in login flow

[Mukil Loganathan (langchain-infra)]

Summary

• include the normalized API origin as the OAuth resource during device-code, device-token, and refresh-token requests
• cover resource handling in login and cmdutil refresh tests
• document why the resource excludes the /api/v1 suffix

Verification

• go test ./...
• live dev login against https://dev.api.smith.langchain.com completed after device-code authorization
• reran workspace/project checks with LangSmith env overrides unset so the saved OAuth profile was used

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.