Cleared CLI v0.2.1 — OAuth callback reliability

Fixes a reproduced login failure when an empty loopback TCP connection arrives before the valid OAuth callback. Harmless unrelated GETs are tolerated within the original timeout; strict callback host/state/path validation remains enforced. This improves callback robustness but does not prove the cause of every intermittent browser failure.

120 Rust tests and quick/full local CI passed. Both macOS targets additionally passed all 19 OAuth regression tests. Four binaries are built from the immutable private source tag cli-v0.2.1; checksums and archive contents verified. macOS ARM64/Linux x86-64 execution native; Intel macOS via Rosetta and Linux ARM64 via QEMU. Both Linux Alpine checks passed. macOS binaries remain unsigned/unnotarized.

Existing v0.2.0 OAuth backend remains compatible and live; no API/web deployment change. Real Privy login, Keychain persistence, customer read and logout were verified during v0.2.0 testing. Invoice/dashboard may report partial coverage from the live data sources.

Install v0.2.1 using the versioned install.sh; run cleared login and cleared auth status --validate. Default consent is read-only; invoice writes also need an active signing session.

Source remains private. Prior releases remain available.