Add AbortSignal support to startCallbackServer and loginAnthropicOAuth
so that pressing Ctrl+C during the browser OAuth flow immediately closes
the HTTP server and 5-minute timer instead of leaving the process hung.
Wire up an AbortController in the TUI browser OAuth path so the cancel
callback aborts the signal on Ctrl+C.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add openBrowser, exchangeCodeForToken, and loginAnthropicOAuth to
src/auth/anthropic.ts, completing the full PKCE OAuth flow. Includes
5 new tests covering happy path, state mismatch, 403 subscription
error, 500 error, and missing access_token cases.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>