feat(sync): add Microsoft account connect CLI

nocal account connect microsoft runs the PKCE browser flow, reads /me,
upserts the deterministic account row, and persists tokens to Secret
Service as the final connected-state gate. Account IDs are hashed from
the remote subject so reconnect is idempotent, and a secret-store
failure leaves the same coherent state as a disconnect. Ships a
placeholder client ID with NOCAL_MICROSOFT_CLIENT_ID override until a
real Entra registration exists.

meson.build

@@ -28,6 +28,7 @@ nocal_sources = files(
   'src/storage/sync_cache.cpp',
   'src/sync/curl_http.cpp',
   'src/sync/desktop_oauth.cpp',
+  'src/sync/microsoft_account.cpp',
   'src/sync/microsoft_graph.cpp',
   'src/sync/oauth.cpp',
   'src/sync/oauth_tokens.cpp',
@@ -81,6 +82,9 @@ test('oauth-tokens', oauth_token_tests)
 token_broker_tests = executable('token-broker-tests',
   'tests/token_broker_tests.cpp', dependencies: nocal_dep)
 test('token-broker', token_broker_tests)
+microsoft_account_tests = executable('microsoft-account-tests',
+  'tests/microsoft_account_tests.cpp', dependencies: nocal_dep)
+test('microsoft-account', microsoft_account_tests)
 secret_store_tests = executable('secret-store-tests',
   'tests/secret_store_tests.cpp', dependencies: nocal_dep)
 test('secret-store', shell,