fix: use OAuth device flow for BYOP

[voodoohop]

• Replaces the localhost URL-fragment callback with Pollinations' OAuth device flow.
• Opens the verification URL and handles the documented polling interval, expiry, pending, and slow-down responses.
• Stores the delegated key with user-only permissions and prevents the project-local key file from being committed.
• Updates setup documentation for the new authorization flow.

The previous callback could not receive an access token from the URL fragment because fragments are never sent to the local HTTP server.

Checks:

• Python compilation
• Mocked pending → slow-down → success flow, client attribution, and 0600 storage
• git diff --check