refactor(auth): implement browser-based and refresh token authentication flow (#15)

## Summary

Adds browser-based OAuth PKCE authentication as an alternative to Service Account login, migrates secret storage to the OS keychain, and fixes several bugs discovered during implementation.

## What changed

### New authentication flow (`src/auth.rs`, `src/context.rs`)
- `fb auth` now offers a choice: **Browser login (PKCE)** or **Service Account**
- Browser flow: opens system browser → local callback server (5 fixed candidate ports) → PKCE code exchange → tokens stored in OS keychain
- After authenticating, interactively selects an account from the API (`GET /web/v3/myAccounts`) — auto-selects if only one account exists
- System engine URL is discovered automatically per account
- Both flows prompt for optional default database/engine

### Keyring-based secret storage
- All secrets (SA client secret, access tokens, refresh tokens) stored in OS keychain via `keyring` crate
- `--no-keyring` flag falls back to `~/.firebolt/fb_secrets` (YAML file)
- Enabled `apple-native` and `linux-native` keyring features — without these the crate compiled with an in-memory mock backend, losing tokens between invocations
- Namespaced keyring keys: `browser_access_token`/`browser_refresh_token` for browser flow, `sa_access_token`/`sa_secret` for SA flow — prevents cross-flow token collisions

### New subcommands
- `fb auth token` — prints current access token to stdout, refreshes if expired

Author: kop

Cargo.lock

@@ -24,3 +24,8 @@ urlencoding = "2.1"
 pest = "2.7"
 pest_derive = "2.7"
 console = "0.15"
+keyring = { version = "3.6.3", features = ["apple-native", "linux-native"] }
+rand = "0.8"
+sha2 = "0.10"
+base64 = "0.22"
+open = "5"

Cargo.toml

@@ -95,6 +95,10 @@ pub struct Args {
     #[serde(default)]
     pub no_spinner: bool,
 
+    #[options(no_short, help = "Store secrets in file instead of OS keychain")]
+    #[serde(default)]
+    pub no_keyring: bool,
+
     #[options(no_short, help = "Update default configuration values")]
     #[serde(skip_serializing, skip_deserializing)]
     pub update_defaults: bool,