feat(auth): use OAuth refresh tokens for CLI sessions

[fatflowers]

Browser login currently exchanges Clerk access tokens for permanent API keys. This change stores OAuth access/refresh tokens and the registered client ID directly, refreshes near expiry, and retries an authenticated API or Router request once after a 401.

• Store credentials atomically with mode 0600; retain static-key env/--key support, migrate ~/.aisa/key, and keep write-only compatibility mirrors.
• Serialize refresh, logout, and login replacement across processes with a heartbeat file lock. Logout and replacement revoke the previous refresh token before removing/replacing credentials.
• Preserve newly issued grants in private recovery files if lock acquisition or cleanup fails, so subsequent login/logout can revoke them. Persist rotated credentials before optional metadata/mirrors; report primary persistence failures explicitly.
• Handle asynchronous credential failures consistently in logout, whoami, and MCP setup. Reject OAuth responses without a usable refresh token before replacing the existing session.
• Update async callers, authentication copy, documentation, and package/E2E checks.

Validation: TypeScript check and build; 350 Vitest tests, including six independent-process tests and injected persistence/lock failures; isolated package smoke. Earlier live Clerk verification covered browser login, refresh-token rotation, balance access, and logout followed by HTTP 400 invalid_grant for the revoked refresh token. Final recovery changes use isolated fault-injection tests, not production credentials.

Limits: already-issued JWT access tokens remain valid until expiry. Third-party client configurations still receive a fixed access-token snapshot; automatic refresh for those clients is outside this change.