feat(server): add OAuth device flow for Google authentication

[jgpruitt]

Summary

Implements OAuth device flow (RFC 8628) for Google authentication (Chunk 7 of server implementation).

Changes

New Files

• packages/server/auth/types.ts - Device flow and OAuth types
• packages/server/auth/device-flow.ts - In-memory device state management
• packages/server/auth/device-flow.test.ts - 21 unit tests for state management
• packages/server/auth/providers/google.ts - Google OAuth configuration
• packages/server/auth/providers/index.ts - Provider registry
• packages/server/auth/index.ts - Module exports
• packages/server/handlers/auth.ts - HTTP request handlers

Endpoints Implemented

Endpoint	Method	Description
/api/v1/auth/device/code	POST	CLI initiates device authorization
/api/v1/auth/device/token	POST	CLI polls for session token
/api/v1/auth/device/verify	GET	User enters code (HTML form)
/api/v1/auth/device/verify	POST	User submits code, redirects to Google
/api/v1/auth/callback/:provider	GET	OAuth callback, creates session

Device Flow

CLI                           Server                        Browser
 │                              │                              │
 │─POST /device/code───────────>│                              │
 │<──{deviceCode, userCode}─────│                              │
 │                              │                              │
 │  "Visit /device/verify       │                              │
 │   Enter code: ABCD-1234"     │                              │
 │                              │                              │
 │                              │<────GET /device/verify───────│
 │                              │─────HTML form───────────────>│
 │                              │                              │
 │                              │<────POST (code)──────────────│
 │                              │─────Redirect to Google──────>│
 │                              │                              │
 │                              │<────GET /callback/google─────│
 │                              │─────"Success! Close window"─>│
 │                              │                              │
 │─POST /device/token──────────>│                              │
 │<──{sessionToken, identity}───│                              │

Features

• User-friendly 8-character codes (XXXX-XXXX format, no ambiguous chars)
• 15-minute device code expiration
• 5-second minimum polling interval (rate limiting)
• CSRF protection via OAuth state parameter
• Clean HTML pages for code entry and success/error

Environment Variables Required

GOOGLE_CLIENT_ID=...
GOOGLE_CLIENT_SECRET=...

Test Results

234 pass (all server tests)
21 device flow tests

Next Chunks

• Chunk 8: OAuth GitHub (feature/server-oauth-github)
• Chunk 9: Rate limiting (feature/server-rate-limit)