feat: add browser-authenticated Canvas and LibTV import beta

[smackgg]

Summary

• add top-level pippit-tool-cli login, status, and logout commands
• open the dedicated Pippit Web authorization page and receive a device-managed AK through a strict loopback callback
• store credentials in the OS keyring, with a hardened Unix fallback; Windows remains keyring-only
• keep XYQ_ACCESS_KEY as an explicit CI override
• add personal Canvas primitives and one-command LibTV import
• resume long imports through credential expiry, media processing, create polling, and ambiguous apply outcomes without blindly replaying writes

Authentication and safety

• browser auth uses the canonical production origin; --ppe-env only routes later business API calls
• callback is bound to exact localhost path, state, secret, source, callback URL, device, and account
• account/device scope is pinned for every import and account switching fails closed
• Pippit and XYQ credentials are removed from browser, LibTV, Canvas-open, and update child-process environments
• AKs are not written to stdout, logs, journals, or command arguments

Verification

• npm test passed, including Node adapter tests, go test ./..., and go vet ./...
• targeted auth and Canvas race tests passed
• Windows amd64 and Linux amd64 builds passed
• every non-doc and non-lock commit is below 1000 changed lines; maximum is 994

Cross-repo dependencies

• Web authorization Draft MR: https://code.byted.org/ies/pippit-cn/merge_requests/3845
• Canvas Bearer-AK server MR: https://code.byted.org/capcut-business/pippit_api/merge_requests/1228

Release gate

Browser login itself reuses existing AK APIs and needs no new login-grant server route or TCC configuration. The complete Canvas import feature still requires pippit_api MR !1228 to be deployed to production and to the selected business PPE lane before this beta is published. Existing AK creation entitlement and quota rules remain enforced.

[smackgg]

Closing this draft to keep the LibTV/import implementation out of the release scope. Browser login and provider-neutral Canvas atomic commands are now isolated in #13; the LibTV work remains preserved on its branch for separate risk review.