feat(sync): add Microsoft account connect CLI

nocal account connect microsoft runs the PKCE browser flow, reads /me,
upserts the deterministic account row, and persists tokens to Secret
Service as the final connected-state gate. Account IDs are hashed from
the remote subject so reconnect is idempotent, and a secret-store
failure leaves the same coherent state as a disconnect. Ships a
placeholder client ID with NOCAL_MICROSOFT_CLIENT_ID override until a
real Entra registration exists.

docs/ARCHITECTURE.md

@@ -288,6 +288,16 @@ This design avoids beta and undocumented per-calendar delta routes. Its
 tradeoff is bandwidth: every secondary window is fetched completely on each
 refresh, while the primary calendar remains incremental.
 
-There is no account UI or CLI orchestration and no live Microsoft credential
-integration yet; tests use injected transports and credentials. Remote writes
-remain out of scope. Account setup and orchestration are next.
+Account setup now has a CLI entry point, `nocal account connect microsoft`.
+It composes the desktop OAuth adapters, libcurl transport, token parsing, one
+`/me` identity read, the sync cache, and the Secret Service store in a fixed
+order: the account row is upserted first, and the versioned secret payload is
+stored last as the connected-state gate. A secret-store failure therefore
+leaves the same coherent state as a disconnect, and reconnecting is idempotent
+because the local account id is a deterministic hash of the remote subject.
+This build carries a placeholder client ID; a real Entra registration is
+supplied through the `NOCAL_MICROSOFT_CLIENT_ID` environment variable (a
+public client ID, never a secret). There is no account TUI and no sync
+orchestration yet; tests use injected transports and credentials. Remote
+writes remain out of scope. Generic `SyncProvider` integration and observable
+sync status are next.