[Enhancement]: Browser sign-in with PKCE for OIDC upstreams #1697

Affected area

Framework integrations, Documentation or examples

Problem or opportunity

nemo-relay auth login (#1611) supports only the OAuth device grant. Some issuers do important work on their browser consent page, and the device grant never reaches it.

OpenRouter is one of them. It creates the user's grant and its API key on its consent page. The device grant is approved on Clerk's own page, so:

• A user who never signed in through a browser gets HTTP 401 on every request.
• A user who did gets that earlier key reused without being asked.

Proposed enhancement

1. auth login uses an authorization code with PKCE (S256) by default, returned to a loopback redirect on http://127.0.0.1:<port>/callback.
2. The listener accepts only the redirect that carries this attempt's state. It checks iss when the issuer sends it.
3. Relay opens the default browser and always prints the address.
4. Over SSH, the user approves on any device and pastes the redirect address back into the terminal.
5. --no-browser only prints the address. --callback-port fixes the port, for a port forwarded over SSH.
6. The device grant stays available behind --device.
7. Discovery reads authorization_endpoint, with the same origin check as the token endpoint.

Runtime contract and binding impact

N/A. This changes the CLI sign-in only. The gateway reads the stored sign-in as it does today.

Alternatives considered

• Keep the device grant as the default and add the browser flow behind a flag. This keeps today's behavior, but OpenRouter users then get the 401 by default.
• Device grant only. This works with no browser, but it cannot reach a consent page.

Acceptance criteria

• auth login signs in through the browser with PKCE. --device keeps the device grant.
• Paste-back works over SSH and refuses an address from another attempt.
• Tests cover the loopback round trip, paste-back, a wrong state, a declined sign-in and the timeout.
• basic-usage.mdx documents the flow, paste-back and --device.

The browser sign-in part of #1678 implements this. I'll split it to match the design agreed here.