feat(mcp): browser OAuth2 login on first run when no token is cached (#80)

When the bridge has no cached token it now runs the interactive browser login
(using CLIENT_ID/CLIENT_SECRET from its environment) and holds the handshake
until it completes, instead of failing fast. This lets the npx-launched bridge
authenticate with no prior xurl install or setup, then caches and auto-refreshes
the token. Login output stays on stderr so the stdout JSON-RPC channel is
unaffected; set a generous startup_timeout_sec on the server. Headless hosts
authenticate out-of-band first with `xurl auth oauth2 --headless`.