feat: add GitHub Copilot model provider with OAuth device flow

Add a new 'github' model provider backed by the Copilot API
(api.githubcopilot.com), with OAuth device flow for authentication.

- New src/auth/github.ts: device flow login, token storage at
  ~/.config/flynn/auth.json with 0600 permissions
- New src/models/github.ts: OpenAI-compatible client with streaming,
  tool calling, and Copilot-specific headers
- Add 'github' to provider enum in config schema
- Register provider in daemon factory and TUI client factory
- Refactor TUI to use provider-agnostic client factory (was hardcoded
  to AnthropicClient for all tiers)
- Add /login command to TUI for interactive OAuth authorization
- Add Copilot model cost tracking entries

src/daemon/index.ts

@@ -1,6 +1,6 @@
 import { Lifecycle } from './lifecycle.js';
 import type { Config, ModelConfig } from '../config/index.js';
-import { AnthropicClient, OpenAIClient, OllamaClient, LlamaCppClient, GeminiClient, BedrockClient, ModelRouter, DEFAULT_RETRY_CONFIG } from '../models/index.js';
+import { AnthropicClient, OpenAIClient, OllamaClient, LlamaCppClient, GeminiClient, BedrockClient, GitHubModelsClient, ModelRouter, DEFAULT_RETRY_CONFIG } from '../models/index.js';
 import type { ModelClient, RetryConfig } from '../models/index.js';
 import { AgentOrchestrator, type DelegationConfig } from '../backends/index.js';
 import { SessionStore, SessionManager } from '../session/index.js';
@@ -109,6 +109,12 @@ export function createClientFromConfig(cfg: ModelConfig): ModelClient {
         accessKeyId: cfg.api_key,
         secretAccessKey: cfg.auth_token,
       });
+    case 'github':
+      return new GitHubModelsClient({
+        model: cfg.model,
+        apiKey: cfg.api_key,
+        endpoint: cfg.endpoint,
+      });
     default:
       throw new Error(`Unknown model provider: ${(cfg as Record<string, unknown>).provider}`);
   }