Cross-posting: `POST /api/auth/{provider}/link` and OAuth-based sign-in

[Adron]

Two unimplemented pieces

1. POST /api/auth/{provider}/link — the generic link endpoint, unimplemented. The app links via browser OAuth handoff only.

2. Sign in with a linked account. Per /help/account: "Once linked, you can sign in with GitHub, Mastodon, and Bluesky." LoginWindow offers email/password, register and forgot-password only.

Constraint

CLAUDE.md: no WebView2 — OAuth opens the OS default browser and the user returns. For sign-in that is awkward, because the callback lands in a browser session while this client needs a bearer sync-token from POST /api/auth/sync-token.

Acceptance criteria

• Establish live whether an OAuth callback can yield a sync-token for a native client, or whether it only establishes a cookie session.
• If only a cookie session: do not ship a sign-in button that cannot work — record the finding in CLAUDE.md and close this with that conclusion.
• If a token is obtainable: an OAuth sign-in path in LoginWindow, reusing the existing browser-handoff pattern.
• POST /api/auth/{provider}/link implemented if it improves on the current handoff.