feat: migrate auth to standard OAuth 2.0 with keychain storage

[lohnim]

Summary

• Migrate from custom /login + /api/cli/token endpoints to standard OAuth 2.0 (/oauth/authorize + /oauth/token with PKCE + state for CSRF protection)
• Store credentials in OS keychain via cross-keychain (macOS Keychain, Linux Secret Service, Windows Credential Manager, AES-256-GCM encrypted file fallback) instead of plaintext config.json
• Backward compatible: legacy tokens in config.json still work until next login, then get cleaned up

Test plan

• alchemy auth — full OAuth flow, verify token stored in keychain (security find-generic-password -s alchemy-cli)
• alchemy auth status — shows storage backend and expiry
• alchemy auth logout — clears keychain entry
• alchemy auth login --force — revokes + re-authenticates
• Run with ALCHEMY_AUTH_URL override for staging
• Verify legacy config.json tokens still work (backward compat)

🤖 Generated with Claude Code