Inject OAuth access token into agent sessions + replace echo signals with curl + wire auto-advancement

[olsonjeffery]

Summary

This PR injects OAuth access tokens into agent LLM sessions, replaces echo-based signal stubs with actual curl commands to the OFM server's agent-flag endpoints, and wires up auto-advancement through the orchestration phases.

Key Changes

Phase 1: In-memory access_token cache

• Added access_tokens: Arc<Mutex<HashMap<Uuid, String>>> to AppState
• Populated on startup background refresh and in POST /api/auth/refresh handler

Phase 2: OFM env vars + curl instructions in context prompt

• Extended build_context_prompt() to accept host/port/pid/access_token
• New "OFM Environment" section with env vars (OFM_HOST, OFM_PORT, OFM_PID, OFM_TASK_ID) and curl instruction table

Phase 3-4: Shared agent-starting function + token wiring

• Extracted start_next_agent() shared function in orchestration/mod.rs
• Refactored post_create_agent_run() to use it
• Access token looked up from cache (or refreshed on demand), written to .ofm_token file

Phase 5: Template updates

• All 4 phase templates updated: planification.md, implementation.md, review.md, pr.md
• Echo signal stubs replaced with curl commands targeting POST /api/tasks/{id}/agent-flags/{action}

Phase 6: Run status reset on resume

• In send_message(), reset task_agent_runs from completed/failed to running before resuming turn

Phase 7: Auto-advancement wiring

• Both agent_runs.rs and conversations.rs broadcast tasks now handle completion_handler's StartAgent response to call start_next_agent()

Phase 8: Token refresh broadcasting

• After successful token refresh (API handler + background task), broadcast "agent token refreshed" UserText to active WS topics

Phase 10: Security hardening

• Token written to .ofm_token file instead of embedding in prompt text (avoids leaking to LLM provider)
• Token removed from GET /api/tasks/{id} response
• .ofm_token added to .gitignore with instructions in context prompt
• Templates read token via $(cat .ofm_token) instead of $OFM_ACCESS_TOKEN

Documentation

• Updated spec/SPEC.md, spec/core/orchestration-loop.md, ARCHITECTURE.md

Testing

• 442/442 unit tests pass, clippy clean
• Manual Playwright scenarios deferred per user acceptance