cloud login: speak the live /auth/device endpoints and auto-open the URL

[KryptosAI]

Context

cloud login today implements RFC 8628 against a generic OIDC issuer (.well-known/openid-configuration), but the hosted IdP (mcp-observatory-cloud) exposes custom endpoints: POST /auth/device mints device_code/user_code and POST /auth/device/token exchanges a JSON {device_code} for a session token. The CLI cannot discover or call these, so login is a manual copy-paste flow that doesn't actually complete against production.

Scope

• Add performCloudDeviceFlow() to src/auth.ts targeting the cloud base URL's /auth/device + /auth/device/token JSON endpoints, matching the session-token shape already stored in ~/.mcp-observatory/auth.json.
• Open the verification URL automatically with the system browser helper after the code is minted.
• Keep generic OIDC device flow for --issuer/--client-id.

Files

• src/auth.ts, src/cli.ts, tests/auth.test.ts

Acceptance

• cloud login completes against production without pasting URLs
• Generic --issuer flow still works
• No tokens in logs or URLs