feat: add Linux OAuth adapters

Add a bounded libcurl transport with verified TLS, no redirects or retries, sanitized failures, binary-safe requests, and resolved-address enforcement for cleartext loopback traffic.

Add shell-free xdg-open launching and a one-shot IPv4 loopback callback receiver with strict HTTP/query parsing, deadlines, fixed callback path, and RAII cleanup. Token parsing, Secret Service, and Graph remain follow-up phases.

shell.nix

@@ -8,8 +8,10 @@ pkgs.mkShell {
   ];
 
   buildInputs = with pkgs; [
+    curl
     gcc
     openssl
     sqlite
+    xdg-utils
   ];
 }