Add browser-based OAuth login through an enrolled TMB instance.
- discover the account and prepare authorization through the TMB
- open the authorization URL and poll the callback result
- persist the returned account session in an owner-only per-instance store
- include account and session state in human-readable and JSON status output
- reject duplicate login while an active local TMB session exists
This creates and stores the session but leaves authenticated PDS requests and refresh handling to the next pull request.