v0.5.0 feat: add cross-device OAuth login

[kev1n]

Summary

• Make anyapi login start RFC 8628 device OAuth for immediate cross-device account sign-in.
• Keep anyapi login --api-key as the local manual-key path and keep anyapi connect as the trial-upgrade PKCE flow.
• Persist and automatically rotate OAuth refresh tokens, including migration for OAuth configs created by CLI 0.3 and 0.4.
• Prevent manual keys and new trial keys from being overwritten by stale OAuth session state.
• Release as 0.5.0 with updated bundled onboarding guidance.

Test coverage

• 84 CLI tests pass across 10 files.
• Device polling covers pending, slow-down, denial, server expiry, local expiry, omitted interval, malformed responses, and a hung token request aborted at the device deadline.
• Auth tests cover refresh rotation, refresh windows, legacy client provenance migration, token validation, and credential switching.
• TypeScript build and git diff --check pass.

Pre-landing review

Three independent review passes are clean after fixes. The reviews specifically checked RFC 8628 behavior, refresh-token lifecycle, API-key isolation, legacy config migration, endpoint fallback, and release ordering.

Documentation

README, changelog, and the bundled onboarding skill describe the new login path and its distinction from trial upgrade and manual-key storage.

Test plan

• npm test
• npm run build
• node dist/index.js login --help
• git diff --check