Add one-time browser authorization flow

[askac]

Summary

• require browser authorization before remote SSH, Local Shell, or UART access
• mint one-time, process-scoped Browser Authorization URLs on demand
• write and accept browser authorization files automatically after grant validation
• replace remote connection controls with a first-use authorization gate
• show the launcher Session ID in Web, GUI, and TUI surfaces

Security

• authorization grants expire after 120 seconds and are consumed once
• unauthorized remote sockets cannot attach to or control existing protected terminals
• pasted Auth URLs must use HTTP or HTTPS and include an authorization grant

Verification

• tools/.venv_wsl/bin/python tests/agent_backend_smoke.py
• tools/.venv_wsl/bin/python tests/agent_browser_smoke.py
• tools/.venv_wsl/bin/python -m py_compile app.py scripts/access_window.py tests/agent_backend_smoke.py tests/agent_browser_smoke.py
• git diff --check

Release target: v2.6.0