feat(auth): add origin-bound saved-credential challenges

[SarthakWade]

Summary

• detect confirmed top-level login forms and return structured, untrusted AUTH_REQUIRED challenges with exact-origin aliases
• add short-lived, session-bound, document-bound, single-use alias login orchestration
• add auth login --interactive with native secure macOS input and foreground /dev/tty input on Linux
• verify login before a separate save decision, default save consent to No, and persist approved candidates through the trusted broker only
• fail closed on Linux saved use until a trusted per-use confirmation surface exists while retaining interactive login and Secret Service vault management

Security

• passwords never enter the public socket, MCP parameters, process arguments, environment, JSON output, flows, or input-event payloads
• challenge use revalidates expiry, session, document, origin, form targets, method, and effective submission destination after approval
• persistence is offered only after verified authentication and sends one bounded binary frame to a parent-authenticated broker
• MFA, CAPTCHA, passkeys, cross-origin frames, denial, replay, redirects, and ambiguous verification return explicit states without replaying the original action
• candidate secrets are cleared on every host and broker return path

Verification

• pnpm test
• pnpm test:runtime
• pnpm test:npm
• pnpm build
• pnpm test:e2e:mac
• GitHub CI Linux Docker E2E
• GitHub release builds for macOS, Linux amd64, and Linux arm64
• pinned Prettier check and git diff --check
• pnpm audit --prod: no known vulnerabilities

Local Linux Docker E2E could not run because Docker Desktop's daemon was non-responsive. GitHub CI provides the independent Linux gate.

Scope

This completes the trusted interactive CLI/native save-consent path. Private in-memory credentials remain in #35. The Settings window remains in #158, and any future agent-deferred save offer must preserve the same trusted user-authorization boundary.

Depends on #177.