feat: add Linux OAuth adapters

Add a bounded libcurl transport with verified TLS, no redirects or retries, sanitized failures, binary-safe requests, and resolved-address enforcement for cleartext loopback traffic.

Add shell-free xdg-open launching and a one-shot IPv4 loopback callback receiver with strict HTTP/query parsing, deadlines, fixed callback path, and RAII cleanup. Token parsing, Secret Service, and Graph remain follow-up phases.

docs/ROADMAP.md

@@ -46,9 +46,21 @@ Completed HTTP/OAuth boundary:
   block user consent
 - No client secret in the open-source desktop binary
 
+Completed concrete Linux adapters:
+
+- libcurl transport with verified TLS, bounded responses/timeouts, no automatic
+  redirects/retries, and cleartext HTTP only for loopback tests
+- Shell-free `xdg-open` launcher and one-shot `127.0.0.1` callback receiver
+  advertising `http://localhost:<dynamic-port>/nocal/oauth/callback`
+- Mobile/Desktop public-client registration at
+  `http://localhost/nocal/oauth/callback`; Microsoft ignores localhost ports,
+  while literal HTTP `127.0.0.1` needs a manifest edit and IPv6 loopback is not
+  supported
+
 Next provider-boundary slices:
 
-- Concrete HTTP, browser/loopback, token JSON, and Secret Service adapters
+- Token JSON parsing and a Secret Service adapter isolated off the render thread
+  because synchronous libsecret calls may block
 - OAuth secrets in Secret Service, never SQLite
 - Generic `SyncProvider` contract and observable sync status
 
@@ -65,12 +77,11 @@ Next provider-boundary slices:
   ETag-aware remote writes after the conflict boundary is proven
 - Account/calendar management UI and per-calendar ANSI identity
 
-The cache and generic HTTP/OAuth boundaries are prerequisites, not usable
-Microsoft 365 integration. The boundary phase has no concrete HTTP transport,
-real browser/loopback adapter, token parser, Secret Service backend, Graph call,
-or account setup. The immediate sequence is concrete desktop, HTTP, and Secret
-Service adapters, then read-only Microsoft Graph discovery and delta
-synchronization.
+The cache, generic HTTP/OAuth boundary, and concrete Linux adapters are
+prerequisites, not usable Microsoft 365 integration. There is still no token
+parser, Secret Service backend, Graph call, or account UI. The immediate sequence is token parsing plus an
+off-render-thread Secret Service adapter, then read-only Microsoft Graph
+discovery and delta synchronization.
 
 ## 1.0 — distribution quality