fix: support browser login from headless CLI

[guantw]

Changes

• Add adaptive auto browser selection for desktop, WSL, SSH, CI, and headless Linux sessions.
• Add an external browser handoff with a structured auth_required event, configurable callback port and timeout, and same-port loopback forwarding guidance.
• Harden callback binding, CSRF comparison, cancellation, post-callback browser shutdown handling, fallback logging, and one-time URL redaction.
• Document the browser requirement, cached-token behavior, migration path, and the exact platforms covered by real login verification.

Validation

• python -m ruff format --check . (68 files already formatted)
• python -m ruff check .
• python -m pytest --cov on Windows 11 Pro x64 (292 passed, 2 skipped, 79% coverage)
• Full Ruff and pytest suite on Ubuntu 24.04.4 LTS x86_64 under WSL2 (293 passed, 1 skipped)
• New behavior has account- and device-independent regression coverage
• User-visible changes are documented in CHANGELOG.md
• No token, certificate, private key, UDID, HAP, log, or machine configuration is committed
• No dependencies were added, so THIRD_PARTY_NOTICES.md is unchanged
• Reviewed docs/OPEN_SOURCE_RELEASE.md; this change does not alter portable artifact composition

Manual testing

• Windows 11 Pro x64 source CLI: auto launched an isolated Edge session and completed a real Huawei login, loopback callback, token exchange, DPAPI cache write, and cached-token reuse.
• Ubuntu 24.04.4 LTS x86_64 under WSL2: auto opened the Windows default browser and completed the WSL loopback callback, token exchange, mode-0600 cache write, and cached-token reuse.
• Temporary authentication and verification directories were removed after testing.
• Native Linux/remote SSH, macOS, GUI, USB, HAP signing, and installation were not included in the real-login verification scope; the documentation states these limits explicitly.