Add --browser flag to cloud login for direct OAuth redirect

[KryptosAI]

What

mcp-observatory cloud login uses device authorization flow (RFC 8628) which requires the user to open a URL and type a code. For desktop users, a direct browser redirect is faster.

Add --browser flag that:

1. Starts a local HTTP server on a random port (e.g. http://localhost:18923/callback)
2. Opens the browser to the OIDC authorize URL with redirect_uri=http://localhost:18923/callback
3. Listens for the callback, extracts the authorization code
4. Exchanges it for tokens at the token endpoint

Fall back to device flow when --browser isn't used.

Files

• src/auth.ts — add performBrowserFlow() function
• src/cli.ts — add --browser flag to cloud login

Reference

• cloud login already exists in src/cli.ts with device flow
• OIDC discovery + token exchange logic is in src/auth.ts
• Need a temporary HTTP listener (Node built-in http module), no new deps

Acceptance

• cloud login --browser opens browser, completes OAuth, saves token
• cloud login (no flag) uses device flow as before
• Token stored identically regardless of flow