release 0.7.3

Fixed (#37)

• auth login --no-wait no longer prints the device code, a bearer secret. It stays in the local device-flow store, and auth login --device-flow <flow_id> (the envelope's poll_command) finishes the flow. An agent can now sign a user in across two turns, for example from a phone through a chat bot: send the verification_url (the code is already in it), then finish on the user's reply.