auth: CLI OIDC login — loopback listener and device authorization grant (S-N2 remainder)

[justin13888]

The remainder of S-N2 after #407 (PR #459), which delivers the server relying party (S-N1) and the SDK half of the login flow (AuthClient::begin_oidc_login / complete_oidc_login).

What is owed

• capsule auth login --oidc — a loopback listener in the CLI (capsule-cli/src/oidc.rs): bind an ephemeral 127.0.0.1 port, call begin_oidc_login with http://127.0.0.1:{port}/callback (admitted by OIDC_ALLOW_LOOPBACK_REDIRECT, on by default), open the authorization URL in the browser, receive the redirect, and call complete_oidc_login(state, code). Needs a decision the docs do not carry yet: the browser-open policy (print the URL, or shell out) and the listener's timeout.
• The device authorization grant (RFC 8628) for headless CLI use — POST /v1/auth/oidc/device and a poll route, with an OidcDeviceStore beside OidcAuthorizationStore, and the provider-side polling. Also undesigned in design/authentication.md.
• cli.auth.login.oidc_* locale keys and a capsule auth login --oidc round trip against the dex service capsule-server/compose.yaml ships.

SLICES.md S-N2 reads part until this lands.

[justin13888]

Review round 1 on #459, decision 14: OIDC_ALLOW_LOOPBACK_REDIRECT now defaults to off. The CLI loopback flow this issue owns needs it on — capsule auth login --oidc should tell the operator to set OIDC_ALLOW_LOOPBACK_REDIRECT=true on the server (the dex comment in capsule-server/compose.yaml already does), and the flow's docs should say the same.