feat(auth): add loopback pairing and credential rotation

[abrichr]

Summary

• Replace the unwired Supabase authorization-code path with OpenAdapt Cloud browser login, exact loopback callback validation, S256 PKCE, and one-use oap_ pairing claim.
• Reuse the durable claim, independent validation, atomic keychain promotion, confirmation, and acknowledged rollback path.
• Enforce credential role prefixes. Keep explicit token paste for headless and recovery use.
• Add the 90-day lifetime contract, the server-authoritative 14-day warning, safe one-time rotation, a seven-day overlap, and crash recovery.
• Document the Desktop-to-Cloud authentication contract.

Paired Cloud change

This PR matches OpenAdaptAI/openadapt-cloud#186 at exact commit b3ec47d00930da1e8dd97347f4c9bcadc95496ab.

Keep this PR as a draft. Do not merge it until the Cloud and Desktop agents approve the exact two-sided contract.

Validation

• ruff check on the changed Python source and tests.
• Focused authentication and pairing matrix: 116 passed.
• Wider engine suite with workspace openadapt-types: 543 passed, 4 native doctor tests deselected.
• npm run build.
• npm run test:ui: 67 passed.