Refactor the OAuth flow

[woodruffw]

The current OAuth implementation has some idempotency issues (#136) -- it's easy to misuse, which results in hard to debug errors.

I think the right solution here is to push everything into a context manager and collapse the lifetime distinction between the local listening server and the OAuth request.

Something like this (sketched):

with OAuthFlow(...) as flow:
    # flow contains state for the server, switches to OOB as necessary
    # ...