feat: add TMB client foundation #209

Add the protocol foundation for an optional user-managed OAuth token-mediating backend.

• generate the TMB client types from a fixed private repository revision
• validate simple HTTPS origins and create ES256 device and DPoP proofs
• support explicit one-time enrollment and typed protected XRPC calls
• update device nonces and retry UseDeviceNonce once with a fresh proof
• keep replay, authentication, availability, and malformed-response failures sanitized

This does not change the existing native public-client login or route ordinary PDS traffic through the TMB.