CLI OAuth: never let the browser URL collect the key

For browser-based CLI sign-in (start -> open URL -> provider callback -> CLI polls), use two values: a login id that rides in the URL/OAuth state, and a poll secret that only the CLI holds (store just its hash). Otherwise anyone who sees the URL (history, screenshare) can poll and collect the issued api key. Claim the key atomically with UPDATE ... WHERE status=authorized RETURNING so concurrent polls cannot both receive it. For returning users on a new machine, issue an extra per-device key rather than rotating the only key, or the first machine silently breaks.