Desktop client (Windows + Linux): build hosted-first OAuth login + secure token storage

[ahmetabdullahgultekin]

Why: Desktop is the active client-apps workstream but sits at 2/13 hosted-first features (only OAuthLoopbackClient + SecureTokenStorage scaffolded). The two foundational pieces must land first.

Done when:

• RFC 8252 loopback OAuth client works end-to-end: ephemeral http://127.0.0.1:/callback + Compose hand-off back to the main window (Desktop gap Initialize Repo #1, ~4 d, Agent B WIP).
• Secure token storage implemented: Windows DPAPI via JNA, Linux libsecret via secret-tool/SecretService, AES-GCM fallback (Desktop gap Finalize the PSD #2, ~3 d, Agent C WIP — interface + impls scaffolded).

source: plans/CLIENT_APPS_PARITY.md:134

---

Migrated from plans/CLIENT_APPS_PARITY.md (git history retains the original).