Add tokenless OAuth tunnel connection flow

[edwin-zvs]

Summary

• make tunnel.zarvis.ai the first /remote-connect choice
• ask for a tunnel name in a prefilled TUI editor before OAuth
• remember the last successfully registered name and prefill it on the next use
• form stable URLs as https://<chosen-name>-<stable-user-id>.tunnel.zarvis.ai
• persist a stable non-secret Construct installation ID so the same installation can reclaim its reservation
• replace owner-token configuration with an ephemeral browser OAuth handoff and single-use in-memory credential exchange
• link pinned wstunnel 10.6.1 directly and run it in-process, with no separate executable or PATH requirement
• when stopping a first-party tunnel, open the service logout endpoint to clear the browser session
• display the OAuth link while waiting, then show the public tunnel URL and QR without redundant Basic credentials
• update the accepted tunnel architecture spec

Verification

• focused daemon tunnel tests pass (5)
• focused CLI tunnel-name/logout tests pass
• cargo build
• paired service tests pass in the Go 1.22 Docker image
• stable-name service counterpart: https://github.com/zarvis-ai/construct-service/pull/3
• logout service counterpart: https://github.com/zarvis-ai/construct-service/pull/4

Merge is intentionally held for manual verification.