Replace manual OAuth setup with browser-based PKCE login

[tomas]

Summary

• Replaces the painful "create a CLI app, copy client_id/secret" setup with a one-command browser login: bootic login
• Uses OAuth 2.0 Authorization Code + PKCE (RFC 7636) — only a public client_id is bundled, no secret required
• A minimal local TCP server catches the OAuth callback on a dynamic port (33100–33110), so port conflicts are handled gracefully
• Legacy bootic setup is preserved for users who need a custom OAuth app (non-production environments, self-hosted)

How it works

1. bootic login starts a local callback server on the first free port in 33100–33110
2. Opens the browser to the Bootic auth page (no user input needed for trusted apps)
3. After the user authenticates, the browser redirects to http://localhost:<port>/callback?code=...
4. The CLI exchanges the code + PKCE verifier for an access token via POST /oauth/token
5. Token is stored; user sees "You're now logged in!"

Changes

• lib/bootic_cli/local_server.rb — new minimal TCPServer-based HTTP callback handler
• lib/bootic_cli/session.rb — PKCE helpers, authorization_request, login_with_browser; setup? always true
• lib/bootic_cli/cli.rb — login command rewritten; setup simplified to advanced-only
• spec/local_server_spec.rb — new unit tests for LocalServer
• spec/session_spec.rb — new unit tests for Session PKCE methods and URL construction
• spec/bootic_cli_spec.rb — updated to match new login/setup flow

Test plan

• bundle exec rspec — 110 examples, 0 failures
• bootic login opens browser and completes authentication end-to-end
• bootic login when already logged in prompts to re-authenticate
• bootic setup still works for custom app credentials