Device authentication

The agent starts a device-auth session, shows the returned verification URL, and polls until the user completes sign-in.

Once authorization succeeds, MSX returns an account-bound API key the agent can use as a bearer token.