Add secure CLI device authorization

[nicodes]

Tracked by https://github.com/aviorstudio/termcade-be/issues/75

Risk: high — persistent bearer credentials and authentication UX.

Team No Review was explicitly selected. Review dispatch, review comments, approving verdicts, and approval gates are intentionally skipped. Exact-head CI, security evidence, merge, release, and production verification remain mandatory.

Summary

• replace terminal email/password and signup handling with cancellable device authorization at the canonical pairing surface
• validate and bound untrusted codes, URI, expiry, intervals, statuses, token lifetime, output, response size, and credential types
• retry transient failures, back off expired rounds, verify issued credentials, and persist CLI tokens atomically with mode 0600
• keep offline play/activity queues and library sync behavior while separating CLI and publishing credentials

Verification

• GOFLAGS=-buildvcs=false go test -race -count=1 -timeout 10m ./... ./sdk/...
• GOFLAGS=-buildvcs=false go vet ./... and go vet ./sdk/...
• GOWORK=off GOFLAGS=-buildvcs=false go build ./... and go vet ./...
• five release cross-compiles: linux amd64/arm64, darwin amd64/arm64, windows amd64
• deliberate 0600 gate failure: observed session permissions = 0644, want 0600, then restored and reran green
• deliberate polling-bound gate failure: interval 0 produced unsafe polling interval, then restored and reran green
• deliberate legacy-secret absence gate failure: injected ReadPassword, observed the source gate fail, then restored and reran green

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}