Add OAuth browser sign-in flow

[spencerhcheng]

Summary

• add browser-based Rootly OAuth sign-in alongside existing API key auth
• register an OAuth client dynamically and store the session securely
• refresh access tokens from the stored browser session when needed

Notes

• API key auth remains available as a fallback
• this PR still needs one live end-to-end OAuth test against Rootly before merge

Validation

• node --check src/auth.js
• node --check src/cli.js