Zero-friction OAuth flow built into the binary:
- xmaster config auth → opens browser → user clicks Authorize → done
- One-shot TcpListener callback server on localhost:3000
- PKCE code_verifier/challenge (SHA256)
- State validation (CSRF protection)
- Auto token exchange + save to config
- Auto refresh via ensure_oauth2_token()
- 2-minute timeout with clear error

Bookmarks sync now uses OAuth 2.0 (required by X API):
- xmaster bookmarks sync -c 100 → synced 98 bookmarks
- Full tweet text, author, metrics archived in SQLite
- Survives tweet deletion

All 28 tests passing.