v0.44.0

Client-driven OAuth login (device-code flow)

New vgi_rpc.http.VgiOAuthAuth: an httpx2.Auth that transparently obtains
and refreshes a bearer token on a 401 carrying an RFC 9728 challenge. Ports
the DuckDB VGI extension's production OAuth client (vgi_oauth.cpp) to
Python — RFC 8628 device-code polling (full error taxonomy + retry caps),
RFC 8414 authorization-server discovery, silent token refresh with skew,
the secret-less-proxy token_endpoint override, and a thread-safe
per-instance login state machine.

PKCE (browser-driven authorization-code flow) is not yet implemented —
flow="pkce", or "auto" against a PKCE-only server, raises a clear
NotImplementedError.

Also fixes a real bug in the existing WWW-Authenticate header parsers:
parse_client_id()/parse_client_secret() used a bare regex search that
also matched inside device_code_client_id="..."/device_code_client_secret="...",
so a challenge advertising both would misreport the device client as the
ordinary one. Replaced with a real RFC 7235 auth-param parser
(parse_www_authenticate_params).

OAuthResourceMetadataResponse gains a token_endpoint field (present on
the wire, previously silently dropped by the JSON parser).

Other changes since v0.43.2

• fix(rpc): treat clean socket EOF as normal disconnect
• feat(launcher): resolve_and_connect — launch-or-reuse with retry-on-stale-connect