feat: one-click GitHub sign-in via OAuth device flow

[jamubc]

Why

Onboarding offered the gh CLI and a pasted PAT, but the headline "Sign in with GitHub" button was a disabled placeholder because no OAuth App client id existed. The device-flow code was already implemented in core; this turns it on for a true one-click sign-in.

What Changes

• Set the registered OAuth App client id in credential::device_flow::CLIENT_ID.
• Add a connect_via_oauth command that starts the device flow, returns the user code and verification URL, and polls on a background thread to finish the connect or emit oauth:error.
• Enable the onboarding button: it shows the user code, opens github.com/login/device, and completes when the user authorizes.

ADDED Requirements

Requirement: One-Click OAuth Sign-In

The app SHALL let the user connect via the GitHub OAuth device flow. It SHALL display the user code and open the verification URL, and on authorization it MUST store the token in the Keychain and proceed to the dashboard. The token MUST NOT appear in logs, SQLite, or error output.

Scenario: Connect via device flow

• GIVEN an unconnected user on the onboarding screen
• WHEN they choose "Sign in with GitHub"
• THEN the app shows a user code and opens github.com/login/device
• AND once they authorize, the onboarding window hides, the dashboard opens, and a sync starts

Scenario: Authorization fails or expires

• GIVEN a device flow in progress
• WHEN the code expires or the user denies access
• THEN the app surfaces an error on the onboarding screen
• AND does not connect

Verification

1. Build
   1.1 cargo check --manifest-path src-tauri/Cargo.toml compiles with the new command.
   1.2 npm run check reports 0 errors and 0 warnings.
2. Wiring
   2.1 CLIENT_ID is set and device_flow::is_configured() returns true.
   2.2 connect_via_oauth is registered in the invoke handler and exposed in the api client.
3. Runtime
   3.1 Clicking "Sign in with GitHub" shows a code and opens the verification URL.
   3.2 Authorizing in the browser hides onboarding, opens the dashboard, and starts a sync.
   3.3 An expired or denied attempt surfaces an error and does not connect.