poc: add Better Auth device authorization

[nhyiramante1]

Summary

• Adds Better Auth's Device Authorization plugin
• Adds a browser approval page with explicit Approve/Deny
• Adds a separate-origin taskpane simulator
• Polls for a Bearer token and verifies it through /api/protected

What This Proves

• The taskpane can initiate login without a session cookie
• The browser can authenticate and approve a public user code
• The taskpane can receive a Bearer token by polling with its private device code
• The token authenticates a protected Hono route

Out Of Scope

• Production backend integration
• Real Word taskpane integration
• Google Docs integration
• Production token storage

Test Plan

• Start backend on port 3001
• Start taskpane simulator on port 3002
• Complete Google login and explicit approval
• Confirm polling returns an access token
• Confirm /api/protected returns the signed-in user using Bearer auth only